CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
The The Events Calendar plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to an improper capability check on the 'can_edit' and 'can_delete' function in all versions up to, and including, 6.15.16. This makes it possible for authenticated attackers, with Contributor-level access and above, to update or trash events, organizers and venues via REST API.
Explanation of Vulnerability in Simple Terms
The Events Calendar through version 6.15.16 contains an integrity and availability vulnerability affecting authenticated users. An attacker with low-level access can modify event data or degrade system performance. The vulnerability requires network access and valid login credentials but no additional user interaction.
What an attacker can do
Modify event data or cause the site to become slow or unresponsive.
Potential impact on your site
Event information could be altered by unauthorized users, or the site could experience performance degradation.
Conditions required to exploit
Attacker must have a valid user account with low-level permissions on the site.
Key dates
External resources
Related vulnerabilities
