PT-2026-3348 · WordPress · Wordpress Community Events
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
WordPress Community Events plugin versions prior to 1.5.7
Description
The Community Events plugin for WordPress has a flaw that allows unauthorized modification of data. A missing capability check within the
ajax admin event approval() function permits unauthenticated attackers to approve events by manipulating the eventlist parameter.Recommendations
Update the WordPress Community Events plugin to version 1.5.7 or later.
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Wordpress Community Events