CVE-2026-57747 is a Cross-Site Request Forgery (CSRF) vulnerability in ThemeREX Booked affecting versions up to 3.0.0. The vulnerability is unauthenticated, meaning it can be triggered without prior authentication, potentially causing denial of service or disruption of availability. The CVSS vector indicates the attack requires no privileges and user interaction is required, with network attack vector and low attack complexity. Confidentiality and integrity impacts are not present, but availability impact is high. No vendor advisory or patch information is currently available.

The vulnerability can be exploited remotely without authentication but requires user interaction. It does not impact confidentiality or integrity but can cause a high impact on availability, potentially disrupting service or causing denial of service conditions in affected Booked installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as verifying anti-CSRF tokens in requests or applying other web application firewall rules to mitigate CSRF risks. Monitor vendor channels for updates.