CVE-2023-6243

Name of the Vulnerable Software and Affected Versions The EventON PRO - WordPress Virtual Event Calendar Plugin plugin versions up to, and including, 4.6.8

Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the admin test email function. This allows unauthenticated attackers to send test emails to arbitrary email addresses via a forged request if they can trick a site administrator into performing an action such as clicking on a link.

Recommendations For versions up to, and including, 4.6.8, update to the latest version to mitigate risks. As a temporary workaround, consider restricting access to the admin test email function until a patch is available. Avoid using the vulnerable function in administrative tasks until the issue is resolved.