Events Manager WordPress Plugin Cross-Site Request Forgery Vulnerability Allowing Location Deletion
Vulnerability
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Events Manager WordPress plugin, specifically in versions through 7.2.2.2. The issue arises from inadequate nonce validation on the 'location_delete' action, enabling unauthenticated attackers to delete locations by tricking a site administrator into clicking a link.
Impact
Exploitation of this vulnerability allows for unauthorized deletion of location data within the Events Manager plugin.
Remediation
Users can update to version 7.2.2.3 or a newer patched version to address this vulnerability.
Added: Dec 12, 2025, 12:25 PM
Updated: Dec 12, 2025, 3:30 PM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
0.6exploitability
7.0remediation
7.7relevance
1.3threat
3.2urgency
2.9incentive
1.7Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.