Event Monster < 1.2.0 - Visitors Deletion via CSRF

Vulnerability

The Event Monster WordPress plugin versions prior to 1.2.0 does not include a Cross-Site Request Forgery (CSRF) check in the functionality for deleting visitors [1]. This means that requests to delete a visitor are not validated against a secret token tied to the user's session, making the action susceptible to CSRF attacks. The vulnerable code path is reached when an administrator with visitor management privileges is logged in and visits a page crafted by an attacker [1].

Exploitation

An attacker can craft a malicious link or webpage that, when visited by a logged-in administrator, triggers a request to delete a specific visitor on the victim's WordPress site [1]. No authentication is needed by the attacker; they only need to lure an authenticated admin to the crafted page (e.g., via email or a compromised site) and the admin's browser will automatically send the forged request, including the admin's session cookies, to the vulnerable endpoint [1].

Impact

A successful CSRF attack allows an attacker to delete arbitrary visitors from the Event Monster system without the admin's knowledge or consent [1]. This can lead to loss of event attendance data and disruption of the event management workflow. The attacker gains no direct code execution or privilege escalation, but the integrity and availability of visitor records are compromised [1].

Mitigation

The vulnerability is fixed in version 1.2.0 of the Event Monster plugin [1]. Users should update to the latest version immediately. There is no known workaround available if unable to update, but the only mitigation is to ensure the admin is not tricked into visiting untrusted pages while logged in. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.