CVE-2023-6158: EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Missing Authorization to Arbitrary Post Meta Update via evo_eventpost_update_meta
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the evoeventpostupdatemeta function in all versions up to, and including, 4.5.4 (for Pro) and 2.2.7 (for free). This makes it possible for unauthenticated attackers to update and remove arbitrary post metadata. Note that certain parameters may allow for content injection. CVE-2024-0238 appears to be a duplicate of this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6158?
CVE-2023-6158 has a severity rating of high due to the potential for unauthorized data modification and loss.
How do I fix CVE-2023-6158?
To fix CVE-2023-6158, you should update the EventON plugin to version 4.5.5 or later for Pro, and version 2.2.8 or later for the free version.
Which versions of the EventON plugin are affected by CVE-2023-6158?
CVE-2023-6158 affects all versions of the EventON plugin up to and including 4.5.4 for Pro and 2.2.7 for the free version.
What kind of data is at risk with CVE-2023-6158?
CVE-2023-6158 puts user-generated event data at risk, allowing unauthorized users to modify or delete event information.
Is authentication required to exploit CVE-2023-6158?
No, CVE-2023-6158 can be exploited without authentication, allowing any user to potentially modify event data.