CVE-2024-0238
Published Jan 16, 2024
Last updated 9 months ago
Overview
- Description
- The EventON Premium WordPress plugin before 4.5.6, EventON WordPress plugin before 2.2.8 do not have authorisation in an AJAX action, and does not ensure that the post to be updated belong to the plugin, allowing unauthenticated users to update arbitrary post metadata.
- Source
- contact@wpscan.com
- NVD status
- Modified
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 6.1
- Impact score
- 2.7
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity
- MEDIUM
Weaknesses
- nvd@nist.gov
- CWE-79
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:myeventon:eventon:*:*:*:*:*:wordpress:*:*",
"vulnerable": true,
"matchCriteriaId": "150D2D60-69AA-4027-AC89-D3929C2C5ECA",
"versionEndExcluding": "2.2.7"
},
{
"criteria": "cpe:2.3:a:myeventon:eventon:*:*:*:*:*:wordpress:*:*",
"vulnerable": true,
"matchCriteriaId": "57B6B80A-D3E7-4D93-B2BA-4A823879356F",
"versionEndExcluding": "4.5.5",
"versionStartIncluding": "4.0"
}
],
"operator": "OR"
}
]
}
]