PT-2026-3348 · WordPress · Wordpress Community Events

Itthidej Aramsri

·

CVE-2025-14029

·

Publicado

2026-01-17

·

Atualizado

2026-01-17

CVSS v3.1

5.3

Média

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions WordPress Community Events plugin versions prior to 1.5.7
Description The Community Events plugin for WordPress has a flaw that allows unauthorized modification of data. A missing capability check within the ajax admin event approval() function permits unauthenticated attackers to approve events by manipulating the eventlist parameter.
Recommendations Update the WordPress Community Events plugin to version 1.5.7 or later.

Correção

Missing Authorization

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-14029

Produtos afetados

Wordpress Community Events