CVE-2024-1125

EventPrime – Events Calendar, Bookings and Tickets (WordPress) is affected by CVE-2024-1125 due to a missing capability check in calendar_events_delete(), impacting all versions up to 3.4.3. This enables authenticated users with subscriber-level access and above to delete arbitrary posts. Affecte...

CVE-2024-1125 EventPrime – Events Calendar, Bookings and Tickets <= 3.4.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the calendareventsdelete function in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with...