PT-2025-21531 · WordPress · The Events Calendar

Bob Matyas · Published 2025-05-15 · Updated 2025-05-15 · CVE-2024-8700

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: The Event Calendar WordPress plugin versions 1.0.0 through 1.0.4

Description: The issue concerns a lack of authorization checks on delete actions, allowing unauthenticated users to delete arbitrary calendars. This means that without proper validation, any user, regardless of their authentication status, can perform deletion actions on calendars.

Recommendations: For The Event Calendar WordPress plugin versions 1.0.0 through 1.0.4, consider disabling the delete action functionality until a patch is available to prevent unauthorized calendar deletions. Restrict access to calendar management features to minimize the risk of exploitation. Avoid using the delete functionality in the affected plugin until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2024-8700

Affected Products

The Events Calendar

References · 4

• 🔥 https://wpscan.com/vulnerability/8c48b657-afa1-45e6-ada6-27ee58185143 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-8700 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8700 · Vendor Advisory
• https://twitter.com/CVEnew/status/1923119303492239461 · Twitter Post