CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Event Espresso Event Espresso 4 Decaf event-espresso-decaf allows Cross Site Request Forgery.This issue affects Event Espresso 4 Decaf: from n/a through <= 5.0.28.decaf.
Explanation of Vulnerability in Simple Terms
Event Espresso 4 Decaf versions up to 5.0.28.decaf contain a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious link or page that, when visited by a logged-in site administrator, performs unwanted actions on the Event Espresso installation without the administrator's knowledge or consent. The vulnerability requires user interaction—the admin must click the link or visit the attacker's page.
What an attacker can do
Perform unwanted actions on Event Espresso (such as modifying events or settings) by tricking an admin into clicking a malicious link.
Potential impact on your site
An attacker can modify Event Espresso configuration, events, or other settings if they trick an admin into visiting a malicious page.
Conditions required to exploit
A logged-in Event Espresso administrator must visit an attacker-controlled page or click a malicious link.
Key dates
External resources
Related vulnerabilities
