CVE-2023-2416

🗓️ 03 Jun 2023 04:35:16Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 39 Views🌐 WEB

The WordPress vcita plugin (up to v4.2.10) is vulnerable to CSRF, allowing unauthenticated users to logout connected accounts, causing denial of service

Reporter	Title	Published	Views	Family All 13
ATTACKERKB	CVE-2023-2416	3 Jun 202305:15	–	attackerkb
Circl	CVE-2023-2416	3 Jun 202312:26	–	circl
CNNVD	WordPress Plugin Online Booking & Scheduling Calendar 跨站请求伪造漏洞	3 Jun 202300:00	–	cnnvd
Cvelist	CVE-2023-2416 Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5 - Cross-Site Request Forgery to Account Logout	3 Jun 202304:35	–	cvelist
EUVD	EUVD-2023-33906	3 Oct 202520:07	–	euvd
NVD	CVE-2023-2416	3 Jun 202305:15	–	nvd
Prion	Cross site request forgery (csrf)	3 Jun 202305:15	–	prion
Positive Technologies	PT-2023-19447 · Vcita · Online Booking & Scheduling Calendar For Wordpress	3 Jun 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-2416	23 May 202501:49	–	redhatcve
Vulnrichment	CVE-2023-2416 Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5 - Cross-Site Request Forgery to Account Logout	3 Jun 202304:35	–	vulnrichment

NVD

Vulners

Node

vcita online_booking_&_scheduling_calendarRange≤4.2.10wordpress

[
  {
    "vendor": "vcita",
    "product": "Online Booking & Scheduling Calendar for WordPress by vcita",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "4.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/f434585c-8533-4788-b0bc-5650390c29a8
plugins	www.plugins.trac.wordpress.org/changeset/3200129/meeting-scheduler-by-vcita/trunk/vcita-ajax-function.php
plugins	www.plugins.trac.wordpress.org/browser/meeting-scheduler-by-vcita/trunk/vcita-ajax-function.php
blog	www.blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita

Parameter	Position	Path	Description	CWE
action	query param	wp-admin/admin-ajax.php?action=vcita_logout	CSRF vulnerability in vcita_logout AJAX action due to missing nonce check allows unauthenticated logout for a vCita connected account.	CWE-352

08 Apr 2026 19:18Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.15.4 - 6.5

EPSS0.0018

SSVC

CWE-352