The EventON WordPress plugin before 2.1.2 does not...
Moderate severity
Unreviewed
Published
Jul 10, 2023
to the GitHub Advisory Database
•
Updated Apr 4, 2024
Description
Published by the National Vulnerability Database
Jul 10, 2023
Published to the GitHub Advisory Database
Jul 10, 2023
Last updated
Apr 4, 2024
The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.
References