SEATT: Simple Event Attendance <= 1.5.0 - 跨站请求伪造可导致任意活动删除

An attacker exploiting this CSRF vulnerability can leverage a malicious link or script to trigger event deletion on a WordPress site. This could lead to data loss, disruption of event schedules, and potential reputational damage. The attacker needs to trick an authenticated administrator into clicking the malicious link, which could be achieved through phishing or social engineering tactics. The blast radius is limited to the events managed by the SEATT plugin and accessible to the administrator targeted by the attack.

WordPress websites using the SEATT: Simple Event Attendance plugin, particularly those with shared hosting environments or where administrators are susceptible to phishing attacks, are at risk. Sites with legacy WordPress configurations or those lacking robust security practices are also more vulnerable.

• wordpress / composer / npm:

grep -r 'SEATT: Simple Event Attendance' /var/www/html/wp-content/plugins/
wp plugin list | grep 'SEATT: Simple Event Attendance'

• generic web:

curl -I https://your-wordpress-site.com/wp-admin/admin-ajax.php?action=seatt_delete_event&event_id=1 | grep 'CSRF token'

1. 2026-02-14Disclosure

   disclosure

1. 已保留2026-02-05
2. 发布日期2026-02-14
3. 修改日期2026-04-08
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2026-1983 is to immediately upgrade the SEATT: Simple Event Attendance plugin to version 1.5.1 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests to the event deletion endpoint with missing or invalid CSRF tokens. Additionally, educate administrators about the risks of clicking on suspicious links and verify the authenticity of requests before performing actions. After upgrading, confirm the fix by attempting to delete an event via a crafted request – it should be rejected.