CVE-2024-8476 is a CSRF vulnerability in the Easy PayPal Events & Tickets WordPress plugin caused by missing or incorrect nonce validation on the wpeevent_plugin_buttons() function. This enables attackers to perform unauthorized post deletions by tricking authenticated administrators into executing malicious requests. The vulnerability affects all versions up to and including 1.2.1. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, but requiring user interaction.

An attacker can cause an authenticated site administrator to unknowingly delete arbitrary posts by exploiting the CSRF vulnerability. This leads to limited integrity impact (unauthorized modification of content) but no confidentiality or availability impact is indicated. The vulnerability does not allow direct data disclosure or system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links while logged into the WordPress admin interface and consider implementing additional CSRF protections or disabling the affected plugin if feasible.