CVE-2023-2416

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the vcita_logout_callback function in versions up to, and including, 4.5. This makes it possible for unauthenticated to logout a vctia connected account which would cause a denial of service on the appointment scheduler, via a forged request granted they can trick a site user into performing an action such as clicking on a link.

• CWE-352
• CWE-352

• https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcitaExploit, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/meeting-scheduler-by-vcita/trunk/vcita-ajax-function.php#L55Exploit
• https://plugins.trac.wordpress.org/changeset/3200129/meeting-scheduler-by-vcita/trunk/vcita-ajax-function.php?old=3191356&old_path=meeting-scheduler-by-vcita%2Ftrunk%2Fvcita-ajax-function.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f434585c-8533-4788-b0bc-5650390c29a8?source=cveThird Party Advisory
• https://blog.jonh.eu/blog/security-vulnerabilities-in-wordpress-plugins-by-vcitaExploit, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/meeting-scheduler-by-vcita/trunk/vcita-ajax-function.php#L55Exploit
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f434585c-8533-4788-b0bc-5650390c29a8?source=cveThird Party Advisory

Published

Jun 3, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-24153A command injection vulnerability in the version parameter i…9.8
• CVE-2023-24154TOTOLINK T8 V4.1.5cu was discovered to contain a command inj…9.8
• CVE-2023-24155TOTOLINK T8 V4.1.5cu was discovered to contain a hard code p…9.8
• CVE-2023-24156A command injection vulnerability in the ip parameter in the…9.8
• CVE-2023-24157A command injection vulnerability in the serverIp parameter …9.8
• CVE-2023-24159TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a com…9.8
• CVE-2023-24160TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a com…9.8
• CVE-2023-24161TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a com…9.8
• CVE-2023-24162Deserialization vulnerability in Dromara Hutool v5.8.11 allo…9.8
• CVE-2023-24163SQL Inection vulnerability in Dromara hutool before 5.8.21 a…9.8
• CVE-2023-24164Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via…9.8
• CVE-2023-24165Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via…9.8