CVE-2022-29434 MEDIUM

CVE-2022-29434: WordPress Spiffy Calendar plugin <= 4.9.0 - Edit/Delete event via IDOR vulnerability

Vendor Spiffy Plugins
Product Spiffy Calendar
Published May 20, 2022
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

Insecure Direct Object References (IDOR) vulnerability in Spiffy Plugins Spiffy Calendar <= 4.9.0 at WordPress allows an attacker to edit or delete events.

Explanation of Vulnerability in Simple Terms

02Summary

Spiffy Calendar version 4.9.0 and earlier contains a vulnerability that allows authenticated users with low privileges to read, modify, or disrupt calendar data. The flaw does not require user interaction and can be exploited over the network. Site administrators should update to a version newer than 4.9.0 to remediate the issue.

What an attacker can do

03Attacker Capabilities

Read, modify, or disrupt calendar data without authorization.

Potential impact on your site

04Site Impact

Low-privilege users can access or alter calendar information they shouldn't be able to.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege account on the site.

Key dates

06Disclosure timeline

May 20, 2022 CVE published
April 28, 2026 Record updated