The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress contains a CSRF vulnerability (CWE-352) due to improper or missing nonce validation on the ssa_factory_reset() function. This allows unauthenticated attackers to reset the plugin's settings if they can trick an administrator into clicking a crafted link or performing a similar action. The vulnerability affects all versions up to and including 1.6.6.20. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, no privileges required, but requiring user interaction. The impact is limited to integrity loss of plugin settings without confidentiality or availability impact. There is no vendor advisory or patch information available at this time.

An attacker can cause an administrator to unknowingly reset the plugin's settings via a forged request, potentially disrupting configured appointment booking settings. There is no direct impact on confidentiality or availability. The integrity of the plugin's configuration is at risk, which might affect the normal operation of the booking system until settings are restored. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when clicking on links or performing actions from untrusted sources. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended to apply any forthcoming patches promptly.