CVE-2026-24942: 
WordPress vulnerability analysis and mitigation

CVE-2026-24942 is a Cross-Site Request Forgery (CSRF) vulnerability in the WpEvently (mage-eventpress) WordPress plugin developed by Magepeople Inc. It affects all versions up to and including 5.1.1, with version 5.1.2 containing the fix. The vulnerability was reported by researcher "daroo" on November 6, 2025, and published by Patchstack on December 6, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), arising from insufficient or absent CSRF token validation in the WpEvently plugin's request handling logic. An unauthenticated attacker can craft a malicious web page or link that, when visited by an authenticated WordPress user, triggers unauthorized state-changing actions on the target site without the user's knowledge. Exploitation requires no special privileges from the attacker but does require user interaction — specifically, a privileged user must be tricked into visiting a crafted page or clicking a malicious link (Patchstack).

Successful exploitation allows a malicious actor to force higher-privileged WordPress users (such as administrators or editors) to execute unwanted actions under their current authentication session, potentially modifying plugin settings, event data, or other site content managed by WpEvently. The integrity impact is low and confidentiality and availability are not directly affected. However, in mass-exploit campaigns targeting thousands of WordPress sites simultaneously, even low-severity CSRF vulnerabilities can result in meaningful unauthorized changes across a large number of installations (Patchstack).

No public proof-of-concept exploit code has been identified for this vulnerability. The EPSS score is approximately 0.016% (0.000160), indicating a very low probability of exploitation in the wild in the near term. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the WpEvently plugin version 5.1.1 or earlier, using tools like WPScan or passive enumeration via search engines.
2. Craft malicious request: Identify a state-changing action within the WpEvently plugin (e.g., modifying event settings or plugin configuration) that lacks CSRF token validation.
3. Build exploit page: Create an HTML page containing a hidden form or JavaScript that automatically submits a forged HTTP request to the target WordPress site's vulnerable WpEvently endpoint, mimicking a legitimate admin action.
4. Deliver to victim: Trick an authenticated WordPress administrator or privileged user into visiting the malicious page via phishing email, social engineering, or a compromised third-party site.
5. Action executes: The victim's browser automatically submits the forged request with their valid session cookies, causing the unauthorized action to be performed on the WordPress site without their knowledge (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to WpEvently plugin endpoints (e.g., paths under /wp-admin/admin-ajax.php or plugin-specific admin pages) from unusual referrer URLs or external domains.
• Application: Unexplained changes to WpEvently plugin settings, event configurations, or other plugin-managed data without corresponding administrator activity.
• Network: HTTP requests to WordPress admin endpoints originating from external or unfamiliar referrer headers, particularly with no matching user-initiated navigation.

The vendor has released version 5.1.2 of the WpEvently plugin, which patches this vulnerability. Site administrators should update the plugin to version 5.1.2 or later immediately via the WordPress plugin dashboard. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, restricting access to the WordPress admin area via IP allowlisting or a web application firewall (WAF) can reduce exposure (Patchstack).