# CVE-2024-32110: Magepeople WpEvently CSRF in WordPress plugin

Source: https://junglewise.ai/threats/cve-2024-32110-magepeople-wpevently-csrf-in-wordpress-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-11. Updated: 2026-06-11  
License: CC BY 4.0 with a link back

CVE-2024-32110 · Severity: medium · CVSS 4.3 · Published 2026-06-11

WpEvently is a WordPress plugin used for managing events and selling tickets via WooCommerce. A security flaw allows an attacker to trick a website administrator into performing unintended actions, such as changing settings or deleting data, by clicking a malicious link. While this requires the administrator to be logged in and interact with the link, it could lead to unauthorized changes to the event management system.

Technologies: [MagePeople WpEvently](https://junglewise.ai/threats/technologies/wpevently). Vendors: [MagePeople](https://junglewise.ai/threats/vendors/magepeople).

## Quick answers

**Is CVE-2024-32110 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-32110 being exploited in the wild.

**How severe is CVE-2024-32110?** Medium severity, with a CVSS score of 4.3, published 11 June 2026.

**Which products and versions are affected?** MagePeople WpEvently <= 4.1.2.

**Is there a fix for CVE-2024-32110?** A patch was published on 2024-04-11: Fixed in version 4.1.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-32110 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-32110?** Check whether you run MagePeople WpEvently at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Magepeople inc. WpEvently plugin (also known as Event Manager and Tickets Selling Plugin for WooCommerce) through version 4.1.2. The vulnerability stems from a lack of proper nonce validation on sensitive administrative functions. An unauthenticated attacker can exploit this by crafting a malicious request and tricking a logged-in administrator into executing it via social engineering (e.g., a malicious link or hidden form). Successful exploitation allows the attacker to perform actions with the privileges of the victim user, though it does not directly allow for data theft (Confidentiality: None). The issue is resolved in version 4.1.3.

## Affected products

- Magepeople inc. WpEvently <= 4.1.2

## Timeline

- 2024-01-23: disclosed: Reported by Dhabaleshwar Das
- 2024-04-11: advisory: Patchstack published advisory
- 2024-04-11: patched: Fixed in version 4.1.3
- 2026-06-11: other: NVD publication date

## References

- [https://patchstack.com/database/wordpress/plugin/mage-eventpress/vulnerability/wordpress-event-manager-and-tickets-selling-plugin-for-woocommerce-plugin-4-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/mage-eventpress/vulnerability/wordpress-event-manager-and-tickets-selling-plugin-for-woocommerce-plugin-4-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve)

## Related threats

- [Magepeople WpEvently cross-site scripting in event content](https://junglewise.ai/threats/cve-2026-116394-improper-neutralization-of-script-related-html-tags-in-a-web)
- [WpEvently Insecure Direct Object References (IDOR)](https://junglewise.ai/threats/cve-2026-81802-wpevently-insecure-direct-object-references-idor)
- [WpEvently broken access control for subscribers](https://junglewise.ai/threats/cve-2026-81761-wpevently-broken-access-control-for-subscribers)
- [WpEvently broken access control in contributor role](https://junglewise.ai/threats/cve-2026-81759-wpevently-broken-access-control-in-contributor-role)