PT-2023-21882 · WordPress · Events Made Easy Wordpress Plugin

Joshua Martinelle · CVE-2023-28660 · Published 2023-03-22 · Updated 2023-03-28

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Events Made Easy WordPress Plugin version <= 2.3.14

Description The issue is an authenticated SQL injection vulnerability. It affects the search name parameter in the eme recurrences list action.

Recommendations For Events Made Easy WordPress Plugin version <= 2.3.14, update to a version greater than 2.3.14 to resolve the issue. As a temporary workaround, consider restricting access to the eme recurrences list action to minimize the risk of exploitation. Avoid using the search name parameter in the affected action until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-28660

Affected Products

Events Made Easy Wordpress Plugin

References · 4

• 🔥 https://tenable.com/security/research/tra-2023-2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-28660 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28660 · Vendor Advisory
• https://t.me/cibsecurity/60517 · Telegram Post