PT-2024-15404 · WordPress · Eventon Premium+1

Erwan Lr · Published 2024-01-16 · Updated 2024-02-05 · CVE-2024-0238

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions EventON Premium WordPress plugin versions prior to 4.5.6 EventON WordPress plugin versions prior to 2.2.8

Description The issue is related to a lack of authorization in an AJAX action, which does not ensure that the post to be updated belongs to the plugin. This allows unauthenticated users to update arbitrary post metadata.

Recommendations For EventON Premium WordPress plugin versions prior to 4.5.6, update to version 4.5.6 or later. For EventON WordPress plugin versions prior to 2.2.8, update to version 2.2.8 or later. As a temporary workaround, consider disabling the AJAX action related to post metadata updates until a patch is available.

Exploit

Fix

Missing Authorization

XSS

Weakness Enumeration

CWE-862

CWE-79

Related Identifiers

CVE-2024-0238

Affected Products

Eventon

Eventon Premium

References · 5

• 🔥 https://wpscan.com/vulnerability/774655ac-b201-4d9f-8790-9eff8564bc91 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-0238 · Security Note
• https://osv.dev/vulnerability/CVE-2024-0238 · Vendor Advisory
• https://twitter.com/CVEnew/status/1747293122374287792 · Twitter Post
• https://t.me/cvenotify/70126 · Telegram Post