CVE-2024-0238

EventON (Free < 2.2.8, Premium < 4.5.6) - Unauthenticated Arbitrary Post Metadata Update

The EventON Premium WordPress plugin before 4.5.6, EventON WordPress plugin before 2.2.8 do not have authorisation in an AJAX action, and does not ensure that the post to be updated belong to the plugin, allowing unauthenticated users to update arbitrary post metadata.

Affected

EventON Premium · EventON

CVSS v3.1 NVD

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.37% chance of exploitation in the next 30 days, 30th percentile

Published

2024-01-16

Updated

2025-06-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/774655ac-b201-4d9f-8790-9eff8564bc91/

Security advisories

• https://wpscan.com/vulnerability/774655ac-b201-4d9f-8790-9eff8564bc91

References

• CVE Record
• NVD entry