CVE-2024-8700

Event Calendar <= 1.0.4 - Unauthenticated Arbitrary Calendar Deletion

The Event Calendar WordPress plugin through 1.0.4 does not check for authorization on delete actions, allowing unauthenticated users to delete arbitrary calendars.

Affected

Event Calendar

CVSS v3.1 CNA

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.47% chance of exploitation in the next 30 days, 40th percentile

Published

2025-05-15

Updated

2025-08-27

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/8c48b657-afa1-45e6-ada6-27ee58185143/

Security advisories

• https://wpscan.com/vulnerability/8c48b657-afa1-45e6-ada6-27ee58185143

References

• CVE Record
• NVD entry