EventPrime < 3.3.6 - Unauthenticated Event Access

2023-12-2900:00:00

Miguel Santareno

wpscan.com

eventprime plugin

unauthenticated access

private events

password protected

authorization

authentication

AI Score

6.9

Confidence

Low

EPSS

0.001

Percentile

17.0%

JSON

Description The plugin lacks authentication and authorization, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id/event name.

PoC

1. Create a password-protected event or a private event then publish it. 2. Access to the URL on a private browser and you will be able to see the password-protected or private event. 3. https://www.example.com/index.php/event/{{EVENT-ID}}/