Quick answers
- Is CVE-2024-32110 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-32110 being exploited in the wild.
- How severe is CVE-2024-32110?
- Medium severity, with a CVSS score of 4.3, published 11 June 2026.
- Which products and versions are affected?
- MagePeople WpEvently <= 4.1.2.
- Is there a fix for CVE-2024-32110?
- A patch was published on 2024-04-11: Fixed in version 4.1.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2024-32110 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2024-32110?
- Check whether you run MagePeople WpEvently at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Magepeople inc. WpEvently plugin (also known as Event Manager and Tickets Selling Plugin for WooCommerce) through version 4.1.2. The vulnerability stems from a lack of proper nonce validation on sensitive administrative functions. An unauthenticated attacker can exploit this by crafting a malicious request and tricking a logged-in administrator into executing it via social engineering (e.g., a malicious link or hidden form). Successful exploitation allows the attacker to perform actions with the privileges of the victim user, though it does not directly allow for data theft (Confidentiality: None). The issue is resolved in version 4.1.3.
Affected products
- Magepeople inc. WpEvently <= 4.1.2
Timeline
- 2024-01-23: disclosed: Reported by Dhabaleshwar Das
- 2024-04-11: advisory: Patchstack published advisory
- 2024-04-11: patched: Fixed in version 4.1.3
- 2026-06-11: other: NVD publication date