CVE-2025-10308 describes a CSRF vulnerability in the Astro Booking Engine plugin for WordPress affecting all versions up to and including 1.4.0. The root cause is the absence of nonce validation on the options deletion feature, which enables attackers to craft forged requests that, when executed by an authenticated administrator, delete the plugin's settings. The vulnerability requires user interaction (UI:R) but no privileges (PR:N) and has a CVSS 3.1 base score of 4.3, indicating medium severity.

An attacker can cause the deletion of all plugin settings by tricking an administrator into clicking a malicious link or performing a similar action. This results in loss of configuration data for the plugin but does not directly impact confidentiality or availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking untrusted links and consider restricting administrative access or using security plugins that provide CSRF protections.