CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through <= 6.15.12.2.
Explanation of Vulnerability in Simple Terms
The Events Calendar for WordPress contains an authorization flaw that allows authenticated users with low privileges to modify or delete event data they should not have access to. The vulnerability affects versions up to 6.15.12.2. An attacker with a basic user account can bypass permission checks to alter event integrity or availability. Update to a version newer than 6.15.12.2 to resolve this issue.
What an attacker can do
Modify or delete events without proper authorization as a low-privilege authenticated user.
Potential impact on your site
Event data can be corrupted or deleted by unauthorized users, disrupting calendar functionality and event management.
Conditions required to exploit
Attacker must have a valid WordPress user account with low privileges (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
