PT-2024-37439 · WordPress · Eventon
CVSS v3.1
7.2
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions:
EventON plugin for WordPress versions up to, and including, 2.2.15
Description:
The issue arises from a missing capability check on the 'eventon import settings' ajax action, allowing unauthenticated attackers to modify data. This enables attackers to update plugin settings, including adding stored cross-site scripting to settings options displayed on event calendar pages.
Recommendations:
For versions up to, and including, 2.2.15, update to a version higher than 2.2.15 to resolve the issue.
As a temporary workaround, consider disabling the
eventon import settings ajax action until a patch is available.
Restrict access to the event calendar pages to minimize the risk of exploitation.Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Eventon