CVE-2026-9721 describes a CSRF vulnerability in the Book a Room Event Calendar plugin for WordPress affecting all versions up to 1.9. The vulnerability arises because the plugin's settings form and update mechanism lack nonce generation and verification, specifically missing wp_nonce_field(), check_admin_referer(), and wp_verify_nonce() calls. The update_settings() function, triggered by the 'action' POST parameter, updates critical plugin configuration options such as database host, username, password, prefix, database name, encryption key, and registration page URL via update_option() without verifying the legitimacy of the request. This flaw enables unauthenticated attackers to modify sensitive plugin settings by tricking an administrator into performing an action like clicking a malicious link.

An attacker can cause unauthorized modification of the plugin's database connection settings by exploiting the CSRF vulnerability. This could lead to potential misconfiguration or redirection of plugin data storage, possibly impacting the integrity of the plugin's operation. The vulnerability does not directly disclose data or allow privilege escalation but can degrade the security posture by altering critical configuration parameters.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links while logged into WordPress with administrative privileges and consider restricting access to the plugin's settings page. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended to apply any forthcoming patches promptly.