Vulnerability · Published Jan 10, 2024 · Assigned by Wordfence
CVE-2023-6158EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Missing Authorization to Arbitrary Post Meta Update via evo_eventpost_update_meta
Medium 6.5
In plain English
A medium-severity missing authorization in EventON – Events Calendar from ashanjay. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Official description
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the evo_eventpost_update_meta function in all versions up to, and including, 4.5.4 (for Pro) and 2.2.7 (for free). This makes it possible for unauthenticated attackers to update and remove arbitrary post metadata. Note that certain parameters may allow for content injection. CVE-2024-0238 appears to be a duplicate of this issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ashanjay | EventON – Events Calendar | 0 – through 2.2.7 |
| EventON | EventON (Pro) - WordPress Virtual Event Calendar Plugin | 0 – through 4.5.4 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L