CVE-2023-3219

🗓️ 10 Jul 2023 12:41:20Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 97 Views🌐 WEB

The EventON WordPress plugin before 2.1.2 allows unauthenticated access to unpublished or protected posts

Reporter	Title	Published	Views	Family All 17
0day.today	Wordpress EventON Calendar 4.4 Plugin - Unauthenticated Post Access via IDOR Vulnerability	4 Aug 202300:00	–	zdt
BDU FSTEC	The vulnerability of the EventOn Lite and EventON plugins of the WordPress content management system allows a hacker to gain unauthorized access to protected information.	22 Nov 202300:00	–	bdu_fstec
CNNVD	WordPress plugin EventON 安全漏洞	10 Jul 202300:00	–	cnnvd
Cvelist	CVE-2023-3219 EventON < 2.1.2 - Unauthenticated Post Access via IDOR	10 Jul 202312:41	–	cvelist
Exploit DB	Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Post Access via IDOR	4 Aug 202300:00	–	exploitdb
Nuclei	EventON Lite < 2.1.2 - Arbitrary File Download	17 Jul 202604:44	–	nuclei
NVD	CVE-2023-3219	10 Jul 202316:15	–	nvd
OSV	CVE-2023-3219	10 Jul 202316:15	–	osv
Packet Storm	WordPress EventON Calendar 4.4 Insecure Direct Object Reference	4 Aug 202300:00	–	packetstorm
Patchstack	WordPress EventON Plugin < 2.1.2 is vulnerable to Insecure Direct Object References (IDOR)	22 Jun 202300:00	–	patchstack

NVD

Vulners

Node

myeventon eventonRange<2.1.2wordpress

[
  {
    "vendor": "Unknown",
    "product": "EventON",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "2.1.2"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/72d80887-0270-4987-9739-95b1a178c1fd
packetstormsecurity	www.packetstormsecurity.com/files/173992/WordPress-EventON-Calendar-4.4-Insecure-Direct-Object-Reference.html

Parameter	Position	Path	Description	CWE
event_id	query param	wp-admin/admin-ajax.php?action=eventon_ics_download	Unauthenticated access to ICS export endpoint via eventon_ics_download where event_id is not validated as a real Event, allowing access to arbitrary post content.	CWE-639

17 Jun 2026 06:13Current

5.6Medium risk

Vulners AI Score5.6

CVSS 3.15.3

EPSS0.07398

SSVC

CWE-639