Event Manager for WooCommerce < 3.5.3 - Unauthenticated Arbitrary Options Reset

The plugin has two AJAX actions, mepwlajaxlicenseactivate and mepwlajaxlicensedeactivate, which are available to both unauthenticated and authenticated users, and are lacking any authorisation, CSRF as well as checks to ensure that the options to be updated belong to the plugin. As a result,...

Event Manager for WooCommerce < 3.5.3 - Unauthenticated Arbitrary Options Reset

The plugin has two AJAX actions, mepwlajaxlicenseactivate and mepwlajaxlicensedeactivate, which are available to both unauthenticated and authenticated users, and are lacking any authorisation, CSRF as well as checks to ensure that the options to be updated belong to the plugin. As a result,...

WordPress Event Manager for WooCommerce plugin <= 3.5.1 - Unauthenticated Arbitrary Options Reset vulnerability

Unauthenticated Arbitrary Options Reset vulnerability discovered by WPScanTeam in WordPress Event Manager for WooCommerce plugin versions = 3.5.1. Solution Update the WordPress Event Manager for WooCommerce plugin to the latest available version at least 3.5.3...