The Simple Event Attendance plugin for WordPress contains a CSRF vulnerability in all releases up to version 1.5.0. The flaw results from the event deletion handler failing to validate a WordPress nonce, which allows an attacker to craft a link or form that an administrator might click while authenticated. If exploited, the attacker can delete any event record on the site, causing data loss and disruption of scheduled activities.

This issue affects the SEATT Simple Event Attendance plugin distributed by sourcez. All installations running an unpatched copy of the plugin, specifically versions 1.5.0 and earlier, are vulnerable. No specific patch level or sub‑version control was identified in the CVE report. Administrators should ensure that they are not using these affected releases.

The CVSS score of 4.3 places the vulnerability in the medium range. The EPSS score is below 1 %, indicating a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack requires social engineering to persuade an administrator to click a forged link, limiting the realistic threat window. Nevertheless, the potential for accidental or intentional loss of event data warrants proactive mitigation.