CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
What the vulnerability does
Deserialization of Untrusted Data vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin.This issue affects Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin: from n/a through 4.1.1.
Explanation of Vulnerability in Simple Terms
The WpEvently plugin for WooCommerce contains a deserialization vulnerability in versions up to 4.1.1. An authenticated attacker with low privileges can supply malicious serialized data that the plugin deserializes without validation, potentially allowing them to read sensitive site data or modify content. The vulnerability requires network access and specific conditions to exploit, but can affect the entire WordPress installation.
What an attacker can do
Read sensitive data or modify site content by submitting malicious serialized objects.
Potential impact on your site
Confidential data could be exposed or site content altered by a low-privilege user account.
Conditions required to exploit
Attacker must be logged in with low-level user privileges; no user interaction required.
Key dates
External resources
Related vulnerabilities
