CVE-2024-32110
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A Cross-Site Request Forgery (CSRF) vulnerability was found in the WpEvently plugin for WordPress up to version 4.1.2. Lack of proper protections allows an attacker to perform unauthorized actions in the context of an authenticated user.
Risk Assessment
An attacker can trick an administrator or other authenticated user into performing unwanted actions, such as changing settings or adding new content, without their knowledge.
Recommendation
It is recommended to update the WpEvently plugin to version 4.1.3 or later, which contains a fix for the CSRF vulnerability.
Other vulnerabilities in WpEvently
See all- CVE-2026-81761Medium
The WpEvently plugin in versions 5.5.0 and earlier has a Broken Access Control vulnerability for subscribers. Subscriber-level users can gain unauthorized access to administrative functions.
- CVE-2026-81759Medium
The WpEvently plugin in versions 5.5.0 and earlier has a Broken Access Control vulnerability for contributors. Contributor-level users can gain unauthorized access to administrative functions.
- CVE-2026-45441High
WpEvently versions up to 5.3.3 contain an unauthenticated vulnerability that could be exploited by attackers.
Original NVD description (English source)
Cross-Site request forgery (CSRF) vulnerability in Magepeople inc. WpEvently allows Cross Site Request Forgery. This issue affects WpEvently: from n/a through 4.1.2.