CVE-2024-1375 is a CSRF vulnerability in the bastho Event post WordPress plugin affecting all versions up to 5.9.10. The vulnerability stems from the absence of a nonce verification in the save_bulkdatas function, enabling attackers to send forged requests that update post_meta_data without proper authorization. Exploitation requires social engineering to induce a logged-in user to perform the action. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) reflects network attack vector, low attack complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality or availability impact, and low integrity impact.

An attacker can cause unauthorized modifications to post metadata by exploiting the CSRF vulnerability, potentially altering site content or behavior. There is no direct impact on confidentiality or availability. The attack requires tricking a logged-in user to interact with a malicious request, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking suspicious links while logged into WordPress and consider disabling or restricting the Event post plugin if possible. Monitor vendor channels for updates regarding a patch or official mitigation.