Cross-Site Request Forgery in Event Registration Calendar Plugin by vcita for WordPress
CVE-2023-2407

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
Event Registration Calendar By Vcita
Online Payments – Get Paid With Paypal, Square & Stripe
Vendor
CVE Published:
3 June 2023

What is CVE-2023-2407?

The Event Registration Calendar and Online Payments plugins by vcita for WordPress are susceptible to Cross-Site Request Forgery (CSRF) due to inadequate nonce validation in the ls_parse_vcita_callback() function. This vulnerability allows unauthenticated attackers to alter plugin settings and potentially inject malicious JavaScript through deceptive requests if they manage to coerce an administrator into executing a specific action, such as clicking a rogue link.

Affected Version(s)

Event Registration Calendar By vcita 0 <= 1.3.1

Online Payments – Get Paid with PayPal, Square & Stripe 0 <= 3.10.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/event-registra...
https://plugins.trac.wordpress.org/browser/paypal-payment...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jonas Höbenreich
.