Authorization Bypass in Events Made Easy Plugin for WordPress
CVE-2023-0404
5.4MEDIUM
What is CVE-2023-0404?
The Events Made Easy plugin for WordPress has a significant vulnerability allowing authenticated attackers to bypass authorization checks. This flaw arises from missing capability validations on several AJAX-related functions, making it possible for users with subscriber-level permissions to execute functions meant strictly for administrators. While the plugin awaits approval for a fix in the official WordPress repository, users can obtain the patched version directly from the developer's Github page.
Affected Version(s)
Events Made Easy * <= 2.3.16