The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized data importation due to a missing capability check on the 'import_file' function in all versions up to, and including, 4.0.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to import events, speakers, schedules and attendee data.
References
Configurations
History
19 Jul 2024, 15:32
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/1725c7f3-2fac-4714-a63e-6c43694483fc?source=cve - Third Party Advisory | |
| References | () https://plugins.trac.wordpress.org/browser/wp-event-solution/trunk/core/admin/hooks.php#L135 - Product | |
| References | () https://plugins.trac.wordpress.org/changeset/3117477/ - Patch | |
| CWE | CWE-862 | |
| CPE | cpe:2.3:a:themewinter:eventin:*:*:*:*:*:wordpress:*:* | |
| First Time |
Themewinter eventin
Themewinter |
17 Jul 2024, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-07-17 07:15
Updated : 2024-07-19 15:32
NVD link : CVE-2024-6033
Mitre link : CVE-2024-6033
JSON object : View
Products Affected
themewinter
- eventin
CWE
CWE-862
Missing Authorization