The MF Gig Calendar WordPress plugin through 1.2.1 does not have CSRF checks in some places, which could allow attackers to make logged in Contributors and above delete arbitrary events via a CSRF attack
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/b28d0dca-2df1-4925-be81-dd9c46859c38/ | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/b28d0dca-2df1-4925-be81-dd9c46859c38/ | Exploit Third Party Advisory |
Configurations
History
18 Apr 2025, 12:54
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Mf Gig Calendar Project
Mf Gig Calendar Project mf Gig Calendar |
|
| CWE | CWE-352 | |
| CPE | cpe:2.3:a:mf_gig_calendar_project:mf_gig_calendar:*:*:*:*:*:wordpress:*:* | |
| References | () https://wpscan.com/vulnerability/b28d0dca-2df1-4925-be81-dd9c46859c38/ - Exploit, Third Party Advisory |
06 May 2024, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-05-06 06:15
Updated : 2025-04-18 12:54
NVD link : CVE-2024-3756
Mitre link : CVE-2024-3756
JSON object : View
Products Affected
mf_gig_calendar_project
- mf_gig_calendar
CWE
CWE-352
Cross-Site Request Forgery (CSRF)