CVE-2024-4665: EventPrime – Events Calendar, Bookings and Tickets < 3.5.0 - Subscriber+ Arbitrary booking settings update
The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing users to change/cancel bookings for other users. Additionally, the feature is lacking a nonce.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4665?
CVE-2024-4665 is classified as a medium severity vulnerability due to improper permission validation that allows unauthorized booking changes.
How do I fix CVE-2024-4665?
To fix CVE-2024-4665, update the EventPrime plugin to version 3.5.0 or later.
What are the consequences of CVE-2024-4665?
The consequences of CVE-2024-4665 include the potential for users to change or cancel bookings made by other users, leading to misuse.
Is CVE-2024-4665 exploitable without authentication?
Yes, CVE-2024-4665 can be exploited by an authenticated user with insufficient permissions due to the lacking proper validation.
What about nonce protection in CVE-2024-4665?
CVE-2024-4665 lacks nonce protection, making it easier for attackers to perform unauthorized actions without a valid CSRF token.