CVE-2023-2416

🗓️ 03 Jun 2023 04:35:16Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 45 Views🌐 WEB

The WordPress vcita plugin (up to v4.2.10) is vulnerable to CSRF, allowing unauthenticated users to logout connected accounts, causing denial of service

Reporter	Title	Published	Views	Family All 14
ATTACKERKB	CVE-2023-2416	3 Jun 202305:15	–	attackerkb
Circl	CVE-2023-2416	3 Jun 202312:26	–	circl
CNNVD	WordPress Plugin Online Booking & Scheduling Calendar 跨站请求伪造漏洞	3 Jun 202300:00	–	cnnvd
Cvelist	CVE-2023-2416 Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5 - Cross-Site Request Forgery to Account Logout	3 Jun 202304:35	–	cvelist
EUVD	EUVD-2023-33906	3 Oct 202520:07	–	euvd
NVD	CVE-2023-2416	3 Jun 202305:15	–	nvd
OSV	CVE-2023-2416	3 Jun 202305:15	–	osv
Prion	Cross site request forgery (csrf)	3 Jun 202305:15	–	prion
Positive Technologies	PT-2023-19447 · Vcita · Online Booking & Scheduling Calendar For Wordpress	3 Jun 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-2416	23 May 202501:49	–	redhatcve

NVD

Vulners

Node

vcita online_booking_&_scheduling_calendarRange≤4.2.10wordpress

[
  {
    "vendor": "vcita",
    "product": "Online Booking & Scheduling Calendar for WordPress by vcita",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "4.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/f434585c-8533-4788-b0bc-5650390c29a8
plugins	www.plugins.trac.wordpress.org/changeset/3200129/meeting-scheduler-by-vcita/trunk/vcita-ajax-function.php
plugins	www.plugins.trac.wordpress.org/browser/meeting-scheduler-by-vcita/trunk/vcita-ajax-function.php
blog	www.blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcita

Parameter	Position	Path	Description	CWE
action=vcita_logout	query param	/wp-admin/admin-ajax.php?action=vcita_logout	CSRF vulnerability due to missing nonce check on vcita_logout_callback enabling unauthenticated logout via forged request	CWE-352

17 Jun 2026 05:52Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.15.4 - 6.5

EPSS0.00394

SSVC

CWE-352