CVE-2024-6271 Community Events < 1.5 - Event Deletion via CSRF

2024-07-2206:00:06

WPScan

github.com

cve-2024-6271

community events

wordpress

csrf

event deletion

security vulnerability

AI Score

7.1

Confidence

High

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

The Community Events WordPress plugin before 1.5 does not have CSRF check in place when deleting events, which could allow attackers to make a logged in admin delete arbitrary events via a CSRF attack

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:community_events_project:community_events:*:*:*:*:*:*:*:*"
    ],
    "vendor": "community_events_project",
    "product": "community_events",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.5",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]