CVE-2023-2796

The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id.

Score

CVSS 3.1 5.3 Medium

Status

Modified - contact@wpscan.com

Published

2023-07-10

Last modified

2025-02-13

Weaknesses

CWE-862

Affected products

• Eventon (Myeventon)
• Eventon (Unknown)

References

• http://packetstormsecurity.com/files/173984/WordPress-EventON-Calendar-4.4-Insecure-Direct-Object-Reference.html
• https://wpscan.com/vulnerability/e9ef793c-e5a3-4c55-beee-56b0909f7a0d