CVE-2026-1983: CSRF in SEATT: Simple Event Attendance

An attacker exploiting this CSRF vulnerability can leverage a malicious link or script to trigger event deletion on a WordPress site. This could lead to data loss, disruption of event schedules, and potential reputational damage. The attacker needs to trick an authenticated administrator into clicking the malicious link, which could be achieved through phishing or social engineering tactics. The blast radius is limited to the events managed by the SEATT plugin and accessible to the administrator targeted by the attack.

1. Reserved2026-02-05
2. Published2026-02-14
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-1983 is to immediately upgrade the SEATT: Simple Event Attendance plugin to version 1.5.1 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests to the event deletion endpoint with missing or invalid CSRF tokens. Additionally, educate administrators about the risks of clicking on suspicious links and verify the authenticity of requests before performing actions. After upgrading, confirm the fix by attempting to delete an event via a crafted request – it should be rejected.