Cross-Site Request Forgery in EventON WordPress Calendar Plugin
CVE-2023-6242

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Eventon – Events Calendar
Eventon (pro) - WordPress Virtual Event Calendar Plugin
Vendor
CVE Published:
11 January 2024

What is CVE-2023-6242?

The EventON plugin for WordPress exhibits a vulnerability due to insufficient nonce validation within the evo_eventpost_update_meta function. This security flaw allows unauthenticated attackers to potentially manipulate post metadata if they successfully deceive an administrator into executing a malicious request, such as clicking a crafted link. As a result, maintaining robust security protocols and updating to the latest patched versions is essential for all users of the EventON plugin to mitigate this risk.

Affected Version(s)

EventON – Events Calendar 0 <= 2.2.7

EventON (Pro) - WordPress Virtual Event Calendar Plugin 0 <= 4.5.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://docs.myeventon.com/documentations/eventon-changelog/
https://plugins.trac.wordpress.org/changeset/3017578/even...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Francesco Carlucci
.