CVE-2024-2110 is a Cross-Site Request Forgery vulnerability in the netweblogic Events Manager – Calendar, Bookings, Tickets, and more! WordPress plugin. The issue arises from missing or incorrect nonce validation on multiple actions within the plugin, enabling attackers to forge requests that modify booking statuses without authentication. Exploitation requires social engineering to convince an administrator to trigger the malicious request. The vulnerability affects all versions up to and including 6.4.7.1 and has a CVSS 3.1 base score of 4.3, indicating medium severity.

An attacker can modify booking statuses by tricking a site administrator into performing an action such as clicking a crafted link. This could lead to unauthorized changes in booking data, potentially disrupting event management operations. There is no indication of confidentiality or availability impact, and no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about clicking unsolicited links and consider restricting administrative access or implementing additional CSRF protections at the application or web server level.