CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in Roundup WP Registrations for the Events Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Registrations for the Events Calendar: from n/a through 2.12.1.
Explanation of Vulnerability in Simple Terms
Registrations for the Events Calendar plugin for WordPress does not properly check user permissions before allowing modifications to event registration data. A logged-in user with low privileges can alter or disrupt registrations for events, affecting data integrity across the site. The vulnerability requires a valid WordPress account but no special role or capability.
What an attacker can do
Modify or disrupt event registrations without proper authorization.
Potential impact on your site
Event registration data can be altered by unauthorized users, compromising event management and attendee records.
Conditions required to exploit
Attacker must have a valid WordPress user account with low-level privileges.
Key dates
External resources
Related vulnerabilities
