CVE-2024-9711

The EKC Tournament Manager WordPress plugin is vulnerable to a Cross-Site Request Forgery (CSRF) attack in versions prior to 2.2.2 . The root cause is a lack of CSRF checks when updating plugin settings, which could allow an attacker to trick a logged-in administrator into making unauthorized cha...

CVE-2024-9765

The EKC Tournament Manager WordPress plugin (versions prior to 2.2.2 ) is vulnerable to a path traversal flaw due to insufficient validation. This oversight allows a logged-in administrator to download arbitrary system files from outside the WordPress directory, potentially leading to significant...

CVE-2024-9709

The EKC Tournament Manager WordPress plugin, in versions prior to 2.2.2 , is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a lack of CSRF checks when updating plugin settings. This flaw could allow an attacker to force a logged-in administrator to modify these settin...