CVE-2024-0237 EventON (Free < 2.2.9, Premium <= 4.5.8) - Unauthenticated Virtual Event Settings Update

2024-01-1615:56:59

WPScan

www.cve.org

cve-2024-0237

eventon

wordpress

plugin

security

vulnerability

unauthenticated

virtual events

settings

update

0.001 Low

EPSS

Percentile

20.7%

JSON

The EventON WordPress plugin through 4.5.8, EventON WordPress plugin before 2.2.7 do not have authorisation in some AJAX actions, allowing unauthenticated users to update virtual events settings, such as meeting URL, moderator, access details etc

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "EventON Premium",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "4.5.8"
      }
    ],
    "defaultStatus": "affected"
  },
  {
    "vendor": "Unknown",
    "product": "EventON",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "2.2.7"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/73d1b00e-1f17-4d9a-bfc8-6bc43a46b90b/

0.001 Low

EPSS

Percentile

20.7%

JSON

Related for CVELIST:CVE-2024-0237