A Cross‑Site Request Forgery flaw exists in the WpEvently plugin for WordPress version 5.1.1 and earlier, classified as CWE‑352. This weakness allows an attacker to cause a victim’s browser to send authenticated requests to the site, potentially creating or modifying events on the site without the victim’s consent. The impact therefore is that an authorized attacker could execute arbitrary state‑changing actions on behalf of any logged‑in user.

The vulnerability affects the WpEvently plugin developed by Magepeopleteam. All releases of the plugin up to and including version 5.1.1 are vulnerable. WordPress sites that use this plugin for managing events are therefore at risk; any site that has not yet updated beyond 5.1.1 is potentially impacted.

The CVSS score of 4.3 indicates a medium severity, and the EPSS score of less than 1% suggests an overall low probability of exploitation at this time. The flaw is not listed in the CISA KEV catalog. The likely attack vector is a typical CSRF scenario where an attacker tricks an authenticated user into loading a malicious link or web page. If the user is logged in, the attacker can trigger state‑changing requests such as creating or editing events, damaging the site’s integrity.