CVE-2024-13146 Booknetic < 4.1.5 - Staff Creation via CSRF

The Booknetic WordPress plugin before 4.1.5 does not have CSRF check when creating Staff accounts, which could allow attackers to make logged in admin add arbitrary Staff members via a CSRF attack...

CVE-2024-13146

The Booknetic WordPress plugin (versions prior to 4.1.5 ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to a lack of CSRF checks when creating Staff accounts . An attacker could trick a logged-in administrator into adding arbitrary Staff members, potentially leading to unauthori...

PT-2025-12858 · WordPress · Booknetic

Name of the Vulnerable Software and Affected Versions: Booknetic WordPress plugin versions prior to 4.1.5 Description: The issue concerns a lack of CSRF check when creating Staff accounts, which could allow attackers to make logged-in admins add arbitrary Staff members via a CSRF attack. This cou...