The Oganro Travel Portal Search Widget for HotelBeds APITUDE API contains a CSRF vulnerability in versions up to 1.0. This vulnerability enables attackers to perform unauthorized actions on behalf of authenticated users by exploiting the lack of proper anti-CSRF protections. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact. No official patch or mitigation guidance has been published as of the current information.

Successful exploitation of this CSRF vulnerability could allow an attacker to cause an authenticated user to perform unintended actions within the Oganro Travel Portal Search Widget. The impact is limited to integrity as per the CVSS vector, with no direct confidentiality or availability effects reported. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing standard CSRF protections such as anti-CSRF tokens or verifying the origin of requests if possible. No vendor advisory or official patch information is currently provided.