Cross-Site Request Forgery in Event Registration Calendar Plugin by vcita for WordPress
CVE-2023-2407

6.5MEDIUM

Key Information:

Vendor
Wordpress
Status
Event Registration Calendar By vcita
Online Payments – Get Paid with PayPal, Square & Stripe
Vendor
CVE Published:
3 June 2023

Summary

The Event Registration Calendar and Online Payments plugins by vcita for WordPress are susceptible to Cross-Site Request Forgery (CSRF) due to inadequate nonce validation in the ls_parse_vcita_callback() function. This vulnerability allows unauthenticated attackers to alter plugin settings and potentially inject malicious JavaScript through deceptive requests if they manage to coerce an administrator into executing a specific action, such as clicking a rogue link.

Affected Version(s)

Event Registration Calendar By vcita * <= 1.3.1

Online Payments – Get Paid with PayPal, Square & Stripe * <= 3.9.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/event-registra...
https://plugins.trac.wordpress.org/browser/paypal-payment...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jonas Höbenreich
.