CVE-2024-13437: Book A Room WordPress Plugin CSRF Vulnerability

CVE-2024-13437 Overview

The Book a Room plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 2.9. The flaw stems from missing or incorrect nonce validation on the bookaroom_Settings page. Unauthenticated attackers can update plugin settings by tricking a site administrator into clicking a crafted link. The issue is tracked under CWE-352 and impacts installations of the heightslibrary/book_a_room plugin.

Critical Impact
Attackers can modify Book a Room plugin settings without authentication by inducing an authenticated administrator to interact with a malicious link or page.

Affected Products

Heightslibrary Book a Room plugin for WordPress, versions ≤ 2.9
WordPress sites with the book-a-room plugin active
All configurations exposing the bookaroom_Settings administrative page

Discovery Timeline

2025-02-12 - CVE-2024-13437 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13437

Vulnerability Analysis

The Book a Room plugin exposes an administrative settings handler at the bookaroom_Settings page. The handler processes state-changing POST requests without verifying a valid WordPress nonce token. Because WordPress relies on nonce tokens to bind an action to the current authenticated session, missing validation allows any origin to forge submissions on behalf of a logged-in administrator.

An attacker crafts an HTML page or link that submits a form to the target site's settings endpoint. When an administrator visits the attacker-controlled page while authenticated to WordPress, the browser attaches session cookies to the forged request. The plugin then accepts the request as legitimate and updates its configuration. User interaction is required, which limits opportunistic exploitation but does not prevent targeted attacks against site operators.

Root Cause

The root cause is the absence of a wp_verify_nonce() check (or equivalent capability check) on requests that mutate plugin settings. WordPress provides wp_nonce_field() and check_admin_referer() helpers to bind privileged actions to a session-scoped token. The bookaroom_Settings handler omits this validation, leaving state-changing operations reachable through cross-origin form submission.

Attack Vector

Exploitation is remote and requires administrator interaction. A typical attack chain involves an attacker hosting a page that auto-submits a POST request to /wp-admin/admin.php?page=bookaroom_Settings with attacker-chosen field values. Delivery methods include phishing emails, comments on other sites, or malicious advertisements. The impact is limited to plugin configuration changes, which can degrade booking workflows, redirect confirmation destinations, or alter operational parameters. See the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2024-13437

Indicators of Compromise

Unexpected modifications to Book a Room plugin settings recorded in WordPress audit logs
Administrator-originated POST requests to admin.php?page=bookaroom_Settings with Referer headers pointing to external domains
Absence of a valid _wpnonce parameter in settings-update requests reaching the plugin endpoint

Detection Strategies

Enable a WordPress audit logging plugin and alert on changes to Book a Room configuration values
Inspect web server access logs for POST requests to the bookaroom_Settings page originating from off-site referrers
Correlate administrator browser activity with settings-change events to identify interaction-driven forgery attempts

Monitoring Recommendations

Ingest WordPress and web server logs into a centralized platform and build detections for settings-change events tied to external referrers
Monitor outbound links delivered to administrators (email, chat) for URLs targeting /wp-admin/admin.php?page=bookaroom_Settings
Track plugin version inventory across WordPress estates to identify hosts still running vulnerable Book a Room releases (≤ 2.9)

How to Mitigate CVE-2024-13437

Immediate Actions Required

Update the Book a Room plugin to a version above 2.9 as soon as the vendor publishes a fixed release
If no patched version is available, deactivate and remove the plugin from production sites
Review the current Book a Room configuration for unauthorized changes and restore known-good values
Require administrators to log out of WordPress sessions before browsing untrusted content

Patch Information

No vendor patch URL is listed in the enriched CVE data. Monitor the WordPress plugin page for Book a Room and the Wordfence advisory for a fixed release. Once a patched version is available, apply it through the WordPress admin interface or via WP-CLI.

Workarounds

Restrict access to /wp-admin/ using IP allow-listing at the web server or WAF layer
Deploy a web application firewall rule that blocks POST requests to admin.php?page=bookaroom_Settings lacking a same-origin Referer header
Enforce SameSite=Lax or Strict on WordPress session cookies to reduce cross-site cookie attachment
Train administrators to avoid clicking links to WordPress admin URLs from untrusted sources

bash

# Example NGINX rule to block cross-origin POSTs to the vulnerable settings page
location = /wp-admin/admin.php {
    if ($request_method = POST) {
        set $block "";
        if ($arg_page = "bookaroom_Settings") { set $block "P"; }
        if ($http_referer !~* "^https?://your-site\.example/") { set $block "${block}R"; }
        if ($block = "PR") { return 403; }
    }
}