CVE-2021-4404: 
WordPress vulnerability analysis and mitigation

The Event Espresso 4 Decaf plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in versions up to and including 4.10.11, identified as CVE-2021-4404. The vulnerability was discovered and disclosed on August 16, 2021, affecting the ajaxHandler() function due to missing or incorrect nonce validation (CVE Details, NVD).

The vulnerability stems from improper implementation of security controls in the ajaxHandler() function, specifically the absence or incorrect implementation of nonce validation. This security weakness exists in the plugin's core functionality, with a CVSS score of 4.3 (Medium) indicating moderate severity (Wordfence).

The vulnerability allows unauthenticated attackers to perform actions on behalf of site administrators through forged requests. Specifically, attackers can trick administrators into performing unintended actions, such as opting into notifications, by having them click on malicious links (CVE Details).

Users should update their Event Espresso 4 Decaf plugin to a version newer than 4.10.11, which contains the security fix. The fix implements proper nonce validation in the ajaxHandler() function to prevent CSRF attacks (WordPress Plugin).