The vulnerability CVE-2024-37518 in StellarWP The Events Calendar plugin is a CSRF issue affecting versions through 6.5.1.4. It allows attackers to trick authenticated users into submitting unauthorized requests, potentially leading to limited integrity impact. The CVSS vector indicates the attack can be performed remotely without privileges but requires user interaction. No known exploits are reported in the wild, and no patch or official remediation details are currently provided.

The impact is limited to integrity, with no confidentiality or availability impact. An attacker could cause a logged-in user to perform unintended actions, but the overall severity is medium due to the requirement of user interaction and lack of privilege needed. There are no reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as verifying nonces or tokens in requests and limiting user permissions where possible. Monitor official StellarWP channels for updates.