Event Calendar < 1.1.51 - Subscriber+ Event Creation
CVE-2021-25025

4.3MEDIUM

Key Information:

Vendor
Wordpress
Status
Eventcalendar
Vendor
CVE Published:
17 January 2022

Summary

The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, allowing users with a role as low as subscriber to create events

Affected Version(s)

EventCalendar 1.1.51

References

https://wpscan.com/vulnerability/24fb4eb4-9fe1-4433-8844-...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Krzysztof Zając
.