CVE-2024-0238: EventON (Free < 2.2.8, Premium < 4.5.6) - Unauthenticated Arbitrary Post Metadata Update
The EventON Premium WordPress plugin before 4.5.6, EventON WordPress plugin before 2.2.8 do not have authorisation in an AJAX action, and does not ensure that the post to be updated belong to the plugin, allowing unauthenticated users to update arbitrary post metadata.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0238?
CVE-2024-0238 has a medium severity rating due to its impact on unauthorized access to post metadata.
How do I fix CVE-2024-0238?
To fix CVE-2024-0238, update the EventON Premium WordPress plugin to version 4.5.6 or later.
Which versions are affected by CVE-2024-0238?
CVE-2024-0238 affects EventON versions before 4.5.6 and the EventON WordPress plugin versions prior to 2.2.8.
What type of vulnerability is CVE-2024-0238 classified as?
CVE-2024-0238 is classified as an authentication issue that allows unauthorized users to update post metadata.
Can CVE-2024-0238 be exploited remotely?
Yes, CVE-2024-0238 can be exploited remotely by unauthenticated users due to insufficient authorization in AJAX actions.