CVE-2017-14760

Name of the Vulnerable Software and Affected Versions event-espresso-free plugin version 3.1.37.12.L

Description A SQL Injection issue exists in the event-espresso-free plugin for WordPress. The issue is related to the recurrence id parameter in the /includes/event-management/index.php file, which is accessible via the /wp-admin/admin.php endpoint.

Recommendations For event-espresso-free plugin version 3.1.37.12.L, consider restricting access to the /wp-admin/admin.php endpoint until a patch is available, and avoid using the recurrence id parameter to minimize the risk of exploitation.