Vulnerability · Published Jul 10, 2023 · Assigned by WPScan
CVE-2023-3219EventON < 2.1.2 - Unauthenticated Post Access via IDOR
Medium 5.3
In plain English
A medium-severity security flaw in EventON from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 7.5% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)5.3Medium
Exploit odds (30 days)7.5%top 5.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Nuclei
Official description
The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.