WORDFENCE-a620810d-1b2a-4f2e-943c-aacc493f0c5b
high
📛 Threat Title
Event Easy Calendar <= 1.0.0 - Multiple Cross-Site Request Forgery
Description
The Event Easy Calendar plugin for WordPress is vulnerable to Multiple Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to perform administrative actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. These actions include creating and updating customers, creating new services and coupons, changing settings, enabling reminders and auto approvals, deleting all bookings, modifying the PayPal recipient email address, and modifying cost of services. Affected software — plugin: Event Easy Calendar (affected: *-1.0). CVSS 8.8 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Indicators of Compromise (0)
No indicators of compromise on this threat.
References (2)
Remediations (1)
-
Wordfence remediation: Event Easy CalendarWordfence
No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.