^{CVE-2025-31828:}Cross-Site Request Forgery (CSRF) vulnerability in the WordPress Easy!Appointments plugin (versions ≤ 1.4.2) that could allow an attacker to trigger a settings change on an authenticated site by persuading an unsuspecting user to submit a forged request.

A CSRF vulnerability has been identified in the Easy!Appointments WordPress plugin, affecting versions up to and including 1.4.2. The issue arises from insufficient CSRF protections on the plugin’s settings endpoints, enabling an attacker to induce a settings change by crafting a forged request that a logged-in user unwittingly executes. The vulnerability affects “from n/a through 1.4.2,” and, according to the CVSS data, can be exploited without the attacker having any privileges, requires user interaction, and has partial impact on integrity with no impact on confidentiality or availability. Exploitation relies on the victim’s browser sending a forged request while interacting with a malicious page, making the impact contingent on the victim’s role (typically an administrator or user with sufficient permissions to alter plugin settings).

Overview

This CVE documents a CSRF weakness in the Easy!Appointments WordPress plugin, affecting versions up to 1.4.2. The flaw permits an attacker to coerce a logged-in user to submit a request that changes plugin settings, by exploiting insufficient anti-CSRF protection on the relevant settings actions. The vulnerability is categorized as CWE-352 Cross-Site Request Forgery, has a CVSS v3.1 base score of 4.3 (Medium), and requires user interaction for exploitation. No confidentiality or availability impact is indicated, while integrity can be partially affected through unauthorized settings changes. The issue is exploitable over the network and does not require the attacker to have prior privileges beyond those of the victim.

Remediation

• Upgrade the Easy!Appointments plugin to a version where the fix is applied (latest release beyond 1.4.2).
• If upgrading is not immediately possible, apply a mitigation by temporarily disabling the plugin’s settings changes or restricting access to the settings page to trusted admin users only.
• Ensure the plugin applies proper CSRF protections going forward:
  • Use WordPress nonces on settings forms and verify them on submission (e.g., through check_admin_referer or equivalent).
  • Enforce appropriate capabilities for settings changes (e.g., current_user_can('manage_options')).
  • Validate and sanitize all settings changes server-side.
• After applying the patch, test the workflow to confirm that settings changes require valid CSRF tokens and that forged requests are rejected.
• Monitor for updates from the plugin maintainers and vulnerability disclosures; perform regular security reviews of plugin code paths handling settings.
• As a general safeguard, consider enabling a Web Application Firewall (WAF) or CSRF protections at the site/app layer to block forged requests.

References

• Patchstack. WordPress Easy!Appointments plugin <= 1.4.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability. https://patchstack.com/database/wordpress/plugin/easyappointments/vulnerability/wordpress-easy-appointments-plugin-1-4-2-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
• MITRE CVE-2025-31828. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31828