CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized booking note creation due to a missing capability check on the 'booking_add_notes' function in all versions up to, and including, 4.2.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add a note to the backend view of any booking.
Explanation of Vulnerability in Simple Terms
EventPrime versions up to 4.2.0.0 lack proper authorization checks, allowing authenticated users to modify event data they should not have access to. An attacker with a low-privilege account can alter event information without proper permission validation. The vulnerability affects the plugin's core event management functionality and requires an active user account to exploit.
What an attacker can do
Modify event details and settings without proper authorization.
Potential impact on your site
Event data can be altered by unauthorized users, compromising event integrity and attendee information.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
