CVE-2024-1375 Event post <= 5.9.10 - Cross-Site Request Forgery

The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing nonce check on the savebulkdatas function in all versions up to, and including, 5.9.10. This makes it possible for unauthenticated attackers to update postmetadata via a forged request, granted...

CVE-2024-1375

CVE-2024-1375 affects the WordPress Event post plugin. A missing nonce check in the save_bulkdatas function allows unauthorized bulk updates to post_meta_data in all versions up to 5.9.5. An unauthenticated attacker can exploit this by forging requests, requiring that a logged-in user be tricked ...