CVE-2026-24942 describes a CSRF vulnerability in the magepeopleteam WpEvently plugin for WordPress, affecting all versions up to 5.1.1. The vulnerability allows an attacker to trick authenticated users into submitting unauthorized requests, potentially leading to limited integrity impact. The CVSS vector indicates the attack can be performed remotely over the network with low attack complexity and requires user interaction but no privileges. Confidentiality and availability impacts are not present.

The vulnerability could allow an attacker to cause a logged-in user to perform unintended actions, resulting in limited integrity impact. There is no impact on confidentiality or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying standard CSRF mitigations such as disabling or restricting the plugin if feasible, or limiting user roles that can interact with it. Monitor vendor channels for updates.