CVE-2023-6243: EventON PRO - WordPress Virtual Event Calendar Plugin <= 4.6.8 - Cross-Site Request Forgery via admin_test_email
The EventON PRO - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.8. This is due to missing or incorrect nonce validation on the admintestemail function. This makes it possible for unauthenticated attackers to send test emails to arbitrary email addresses via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6243?
CVE-2023-6243 is a Cross-Site Request Forgery (CSRF) vulnerability that could potentially allow an unauthorized user to perform actions on behalf of an authenticated user.
How do I fix CVE-2023-6243?
To fix CVE-2023-6243, update the EventON PRO - WordPress Virtual Event Calendar Plugin to version 4.6.9 or higher, where nonce validation issues have been addressed.
What versions of the EventON PRO plugin are affected by CVE-2023-6243?
CVE-2023-6243 affects all versions of the EventON PRO - WordPress Virtual Event Calendar Plugin up to and including version 4.6.8.
Is CVE-2023-6243 a serious threat to my WordPress site?
Yes, CVE-2023-6243 poses a serious threat as it allows an attacker to exploit CSRF to perform unauthorized actions.
What functionality is impacted by CVE-2023-6243 in the EventON PRO plugin?
CVE-2023-6243 specifically impacts the admin_test_email function due to missing or incorrect nonce validation.