The OTA Sync Booking Engine Widget plugin for WordPress suffers from a CSRF vulnerability due to improper nonce validation in the otasync_widget_settings_fnc() function. This allows attackers to forge requests that can update plugin settings and inject malicious scripts if a site administrator is tricked into executing the action. The vulnerability affects all versions up to 1.2.7 and has a CVSS 3.1 base score of 6.1 (medium severity). No patch or vendor advisory detailing remediation is currently available.

Successful exploitation could allow an attacker to modify the plugin's settings and inject malicious scripts by leveraging a forged request executed by an authenticated administrator. This could lead to partial compromise of the affected WordPress site, including potential script injection and unauthorized configuration changes. There is no indication of availability impact or known active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links and consider restricting administrative access or implementing additional CSRF protections at the site level. Monitoring for plugin updates from the vendor is recommended.