An unauthenticated Cross Site Request Forgery vulnerability in the FluentBooking Pro plugin for WordPress poses a high risk of unauthorized administrative actions.

The plugin fails to implement sufficient protection against CSRF attacks, allowing unauthenticated attackers to trick authenticated users into executing unintended actions via the application. This vulnerability arises from missing anti-CSRF tokens on sensitive endpoints.

Successful exploitation of this vulnerability can allow an attacker to modify plugin settings or perform unauthorized bookings, leading to potential data integrity loss or service disruption. With a CVSS score of 8.1, the risk is classified as High because it facilitates unauthorized state-changing operations within the WordPress environment.

Immediate Action: Update the FluentBooking Pro plugin to version 2.2.5 or later to resolve the missing token validation.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at plugin-specific endpoints, particularly those originating from external, unauthenticated sources.

Compensating Controls: Deploy a Web Application Firewall with rules configured to detect and block common CSRF patterns and unauthorized requests to the FluentBooking Pro plugin path.

Public Exploit Available: No (exploit_available unknown).

Given the high CVSS severity and the potential for unauthorized administrative actions, organizations utilizing FluentBooking Pro must prioritize updating to version 2.2.5 immediately. Failure to patch leaves the platform open to forced state changes that could compromise the integrity of the booking system.