PT-2023-16245 · WordPress · Events Made Easy

Marco Wotschka · Published 2023-01-19 · Updated 2023-01-26 · CVE-2023-0404

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Events Made Easy plugin for WordPress versions up to, and including, 2.3.16

Description The issue is related to authorization bypass due to a missing capability check on several functions related to AJAX actions. This allows authenticated attackers with subscriber-level permissions and above to invoke functions intended for administrator use.

Recommendations For versions up to, and including, 2.3.16, update to a patched version available directly from the developer's Github.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-0404

Affected Products

Events Made Easy

References · 5

• https://osv.dev/vulnerability/CVE-2023-0404 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2836308%40events-made-easy&new=2836308%40events-made-easy&sfp_email=&sfph_mail= · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-0404 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/5a9e62de-3e70-424f-b8e5-2a5f07ca182d?source=cve · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/5a9e62de-3e70-424f-b8e5-2a5f07ca182d · Note