CVE-2021-25025CWE-352CWE-862

Event Calendar < 1.1.51 - Subscriber+ Event Creation

published January 17, 2022

CVSS
—
EPSS
0%
Percentile
27.0
In the wild
Unconfirmed
What it is

The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, allowing users with a role as low as subscriber to create events

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00347 · 27.0th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-862 · Missing Authorization
Published
2022-01-17T00:00Z
EPSS history
Timeline
  • 17 JAN 00:00Z
    Event Calendar < 1.1.51 - Subscriber+ Event Creation
    cvelistv5