CVE-2024-2110: Pixelite Events Manager CSRF Vulnerability

CVE-2024-2110 Overview

CVE-2024-2110 affects the Events Manager WordPress plugin by Pixelite, which provides calendar, booking, and ticketing functionality. The plugin is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 6.4.7.1. The flaw stems from missing or incorrect nonce validation on several booking-related actions within em-bookings-table.php. Unauthenticated attackers can modify booking statuses by tricking a site administrator into clicking a crafted link. Exploitation requires user interaction and does not expose data confidentiality, but it compromises the integrity of booking records. The issue is tracked under CWE-352.

Critical Impact
Unauthenticated attackers can alter booking statuses on affected WordPress sites by luring an administrator into executing a forged request, undermining the integrity of event and booking data.

Affected Products

Pixelite Events Manager plugin for WordPress, all versions through 6.4.7.1
WordPress sites with the Events Manager – Calendar, Bookings, Tickets plugin installed
Any site where an administrator with booking-management privileges is active

Discovery Timeline

2024-03-28 - CVE-2024-2110 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2110

Vulnerability Analysis

The vulnerability resides in booking-management actions handled by the plugin's em-bookings-table.php component. The plugin processes state-changing requests, such as modifying booking statuses, without validating a WordPress nonce token. WordPress nonces are the standard mechanism for binding sensitive actions to an authenticated session and preventing cross-origin request abuse. Without nonce enforcement, the server cannot distinguish between an administrator-initiated request and a cross-site request forged by an attacker. An attacker hosts a malicious page or link that issues a request to the vulnerable endpoint. When an authenticated administrator visits the page, the browser automatically attaches session cookies and executes the state change on the attacker's behalf. The impact is limited to booking status manipulation, with no direct code execution or data theft.

Root Cause

The root cause is missing or incorrect nonce validation [CWE-352] on booking actions in the Events Manager plugin. The affected functions proceed with state changes based solely on the presence of an authenticated session cookie, omitting calls to wp_verify_nonce() or check_admin_referer() on inbound parameters.

Attack Vector

Exploitation occurs over the network and requires user interaction from a privileged user. An attacker crafts a URL or an auto-submitting HTML form that targets the plugin's booking endpoints. The attacker then delivers the link through phishing, forum posts, comments, or any medium that an administrator may access while logged in to the WordPress site. Upon the administrator loading the resource, the browser issues the forged request, and the plugin modifies the targeted booking status.

No verified public exploit code is available for CVE-2024-2110. See the
Wordfence advisory and the plugin changeset for technical details on the
missing nonce checks in em-bookings-table.php.

Detection Methods for CVE-2024-2110

Indicators of Compromise

Unexpected changes to booking statuses (approved, pending, rejected, cancelled) without corresponding administrator activity in audit logs
HTTP requests to Events Manager booking endpoints with a Referer header pointing to an external, untrusted origin
Administrator sessions issuing booking-modification requests immediately after visiting external links or opening email content

Detection Strategies

Review WordPress access logs for POST or GET requests to Events Manager booking action handlers that lack the plugin's expected nonce parameter
Correlate booking status changes with the originating administrator session and Referer header to identify cross-origin triggers
Deploy a web application firewall rule that flags state-changing requests to plugin endpoints missing a valid nonce token

Monitoring Recommendations

Enable WordPress audit logging to capture user, timestamp, IP, and action for every booking status change
Alert on bulk booking status modifications occurring within short time windows, which may indicate scripted abuse via a forged request
Monitor administrator browser sessions for navigation to untrusted domains followed by immediate plugin API activity

How to Mitigate CVE-2024-2110

Immediate Actions Required

Update the Events Manager plugin to a version later than 6.4.7.1 that contains the nonce validation fix referenced in the plugin changeset 3054883
Audit recent booking status changes to identify any unauthorized modifications and restore legitimate values
Require administrators to log out of WordPress sessions when browsing external content and to use separate browser profiles for administrative work

Patch Information

The maintainers addressed the issue in the Events Manager plugin via WordPress Plugin Repository changeset 3054883, which adds nonce validation to the affected booking actions in classes/em-bookings-table.php. Site operators should install the latest plugin release through the WordPress admin dashboard. Additional context is available in the Wordfence Vulnerability Report.

Workarounds

If immediate patching is not possible, deactivate the Events Manager plugin until the update is applied
Restrict access to the WordPress admin area with an IP allowlist or VPN to reduce exposure of authenticated administrator sessions
Deploy a web application firewall rule that blocks requests to Events Manager booking endpoints when the HTTP Referer does not match the site origin

bash

# Example WordPress CLI command to update the Events Manager plugin
wp plugin update events-manager

# Verify the installed version is newer than 6.4.7.1
wp plugin get events-manager --field=version