The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, allowing users with a role as low as subscriber to create events
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2022-01-17T00:00:00

Updated: 2024-08-03T19:49:14.534Z

Reserved: 2021-01-14T00:00:00

Link: CVE-2021-25025

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2022-01-17T13:15:07.800

Modified: 2024-11-21T05:54:12.580

Link: CVE-2021-25025

cve-icon Redhat

No data.