Knight Squad Academy
Vulnerability advisory

CVE-2026-1983

Research by Md. Tareq Ahamed Jony February 14, 2026
Overview

Summary

The SEATT: Simple Event Attendance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.0. This is due to missing nonce validation on the event deletion functionality. This makes it possible for unauthenticated attackers to delete arbitrary events via a forged request granted they can trick an administrator into performing an action such as clicking on a link.

Risk profile

CVSS assessment

4.3 · M E D I U M
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack vector
N E T W O R K
Complexity
L O W
Privileges
N O N E
User interaction
R E Q U I R E D
Scope
U N C H A N G E D
Confidentiality
N O N E
Integrity
L O W
Availability
N O N E
Classification

Weaknesses

  • Cross-Site Request Forgery (CSRF) CWE-352
Further reading

References

3 sources
  1. plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/simple-event-attendance/tags/1.5.0/seatt_events_admin.php#L23
  2. plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/simple-event-attendance/trunk/seatt_events_admin.php#L23
  3. www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/cdfc1110-7bbd-45f0-97ef-271c45d222c1?source=cve