CVE-2024-2110 Events Manager <= 6.4.7.1 - Cross-Site Request Forgery
Unauthenticated attackers can modify booking statuses by tricking administrators into clicking a link due to missing nonce validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-2110?
CVE-2024-2110 is a medium-severity vulnerability in netweblogic Events Manager – Calendar, Bookings, Tickets, and more!, published on 28 Mar 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.7.1. This is due to missing or incorrect nonce validation on several actions. This makes it possible for unauthenticated attackers to modify booking statuses via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Weakness: CWE-352
Which versions are affected by CVE-2024-2110?
It affects 1 product.
Products include Pixelite Events Manager.
How do I fix CVE-2024-2110?
No fix has been published for CVE-2024-2110 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-2110 being exploited?
There is no known exploitation of CVE-2024-2110 in the wild and no public exploit code.
Other vulnerabilities in netweblogic Events Manager – Calendar, Bookings, Tickets, and more!
- CVE-2015-9298 Code injection in n/a
- CVE-2025-6970 Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter
- CVE-2024-11260 SQL injection in Events Manager – Calendar, Bookings, Tickets, and more!
- CVE-2020-35012 Events Manager < 5.9.8 - Admin+ SQL Injection
- CVE-2023-48326 WordPress Events Manager Plugin <= 6.4.5 is vulnerable to Cross Site Scripting (XSS)
Sources
Also known as GHSA-pcgx-35gv-6fvj.