CVE-2023-3219
MediumCVSS 5.3Exploitation Probability (EPSS)
Very high risk91th percentile - higher than 91% of all known CVEs
Summary
The EventON WordPress plugin before version 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event. This allows unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.
Risk Assessment
Organizations may be exposed to the disclosure of sensitive information as unauthorized users can access protected content. This could lead to privacy breaches and data security issues.
Recommendation
It is recommended to update the EventON plugin to version 2.1.2 or later to mitigate this vulnerability. Additionally, consider implementing further authorization mechanisms for the export functionality.
Original NVD description (English source)
The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.