CVE-2024-38762 Overview
CVE-2024-38762 is a Cross-Site Request Forgery (CSRF) vulnerability in the StellarWP Event Tickets plugin for WordPress. The issue affects Event Tickets versions up to and including 5.11.0.4. An attacker can trick an authenticated user into submitting an unwanted request to a vulnerable endpoint, causing a limited integrity impact on the target site. The flaw is classified under CWE-352 and requires user interaction to succeed.
Critical Impact
Successful exploitation allows an attacker to perform unauthorized state-changing actions on behalf of a logged-in WordPress user of a site running the Event Tickets plugin.
Affected Products
- StellarWP Event Tickets plugin for WordPress
- Event Tickets versions from n/a through 5.11.0.4
- WordPress sites with authenticated users interacting with the plugin
Discovery Timeline
- 2025-01-02 - CVE-2024-38762 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-38762
Vulnerability Analysis
The vulnerability stems from missing or insufficient anti-CSRF protections in one or more request handlers of the Event Tickets plugin. WordPress plugins typically use nonces (wp_nonce_field, check_admin_referer, wp_verify_nonce) to defend against forged requests. When these controls are absent or improperly validated, an attacker-controlled page can force an authenticated victim's browser to issue authenticated requests to the target WordPress site.
The attack requires the victim to be logged in to the target site and to visit a page under the attacker's control. Because the request originates from the victim's authenticated session, the server processes it as legitimate. The impact is limited to integrity, with no direct confidentiality or availability impact.
Root Cause
The root cause is a missing CSRF token verification on a state-changing endpoint within Event Tickets <= 5.11.0.4. Requests that modify plugin state are accepted based solely on the session cookie, without validating a per-request nonce tied to the user and action. This aligns with the CWE-352 weakness class.
Attack Vector
The attack is network-based and requires user interaction. An attacker hosts a malicious page containing a crafted HTML form or JavaScript that submits a request to the vulnerable endpoint on the target WordPress site. When an authenticated administrator or privileged user visits the attacker page, the browser sends the request with valid session cookies. Additional technical detail is available in the Patchstack CVE Analysis.
No public proof-of-concept exploit code is verified for this CVE, so a technical description is provided instead of a code sample. The EPSS probability is approximately 0.195% with a percentile of 9.36, indicating a low predicted exploitation likelihood at this time.
Detection Methods for CVE-2024-38762
Indicators of Compromise
- Unexpected changes to Event Tickets configuration, ticket data, or event settings made by legitimate users without their knowledge.
- HTTP POST requests to Event Tickets endpoints with Referer headers pointing to external, untrusted domains.
- Access log entries showing authenticated actions clustered immediately after users clicked external links.
Detection Strategies
- Review WordPress audit logs for state-changing actions on Event Tickets that lack a matching admin UI navigation trail.
- Inspect web server logs for requests to plugin endpoints where the Referer header is missing or off-domain.
- Correlate user session activity with reported anomalies in ticket configuration or event data.
Monitoring Recommendations
- Enable a WordPress activity log plugin to capture administrative changes tied to Event Tickets.
- Monitor outbound-referrer patterns on plugin endpoints and alert on unusual Referer values.
- Track plugin version inventory across managed WordPress sites to identify hosts still on 5.11.0.4 or earlier.
How to Mitigate CVE-2024-38762
Immediate Actions Required
- Update the Event Tickets plugin to a version later than 5.11.0.4 on all affected WordPress sites.
- Audit recent administrative actions in Event Tickets for unauthorized changes made during the exposure window.
- Require re-authentication for privileged accounts and rotate WordPress session cookies after patching.
Patch Information
StellarWP has addressed the issue in a release subsequent to Event Tickets 5.11.0.4. Refer to the Patchstack CVE Analysis for the fixed version and vendor advisory details. Apply the update through the WordPress plugin manager or via WP-CLI.
Workarounds
- Restrict administrative access to the WordPress dashboard by IP allowlisting until the plugin is updated.
- Deploy a web application firewall rule that enforces Referer and Origin header checks on Event Tickets endpoints.
- Train privileged users to log out of WordPress before browsing untrusted sites.
# Configuration example: update Event Tickets via WP-CLI
wp plugin update event-tickets --version=latest
wp plugin get event-tickets --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
