CVE-2023-0404

The Events Made Easy plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions related to AJAX actions in versions up to, and including, 2.3.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke those functions intended for administrator use. While the plugin is still pending review from the WordPress repository, site owners can download a copy of the patched version directly from the developer's Github at https://github.com/liedekef/events-made-easy
Configurations

Configuration 1 (hide)

cpe:2.3:a:e-dynamics:events_made_easy:*:*:*:*:*:wordpress:*:*

History

21 Nov 2024, 07:37

Type Values Removed Values Added
References () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2836308%40events-made-easy&new=2836308%40events-made-easy&sfp_email=&sfph_mail= - Patch, Third Party Advisory () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2836308%40events-made-easy&new=2836308%40events-made-easy&sfp_email=&sfph_mail= - Patch, Third Party Advisory
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/5a9e62de-3e70-424f-b8e5-2a5f07ca182d - Third Party Advisory () https://www.wordfence.com/threat-intel/vulnerabilities/id/5a9e62de-3e70-424f-b8e5-2a5f07ca182d - Third Party Advisory
Summary
  • (es) El complemento Events Made Easy de WordPress es vulnerable a la omisión de autorización debido a una falta de verificación de capacidad en varias funciones relacionadas con las acciones AJAX en versiones hasta la 2.3.16 incluida. Esto hace posible que los atacantes autenticados, con permisos de nivel de suscriptor y superiores, invoquen aquellas funciones destinadas al uso del administrador. Si bien el complemento aún está pendiente de revisión desde el repositorio de WordPress, los propietarios del sitio pueden descargar una copia de la versión parcheada directamente desde el Github del desarrollador en https://github.com/liedekef/events-made-easy

Information

Published : 2023-01-19 15:15

Updated : 2024-11-21 07:37


NVD link : CVE-2023-0404

Mitre link : CVE-2023-0404

CVE.ORG link : CVE-2023-0404


JSON object : View

Products Affected

e-dynamics

  • events_made_easy
CWE
CWE-862

Missing Authorization