CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 3.4.2. This is due to the plugin allowing unauthenticated users to update the status of order payments. This makes it possible for unauthenticated attackers to book events for free.
Explanation of Vulnerability in Simple Terms
EventPrime versions up to 3.4.2 contain an integrity vulnerability that allows unauthenticated attackers to modify data over the network without user interaction. The vulnerability stems from insufficient input validation or access controls. Site administrators should update to a version newer than 3.4.2 to remediate the issue.
What an attacker can do
Modify data on the site without authentication or user interaction.
Potential impact on your site
Attackers can alter event data, bookings, or ticket information without logging in.
Conditions required to exploit
Network access only; no authentication or user action required.
Key dates
External resources
Related vulnerabilities
