CVE-2024-6180: EventON <= 2.2.15 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting and Plugin Settings Updates
The EventON plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eventonimportsettings' ajax action in all versions up to, and including, 2.2.15. This makes it possible for unauthenticated attackers to update plugin settings, including adding stored cross-site scripting to settings options displayed on event calendar pages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress/EventONto a version that resolves this vulnerability.Fixed in 2.2.15 - Configuration
Modify the EventON plugin to require an authenticated capability check before processing the 'eventon_import_settings' AJAX action; ensure unauthenticated requests cannot update plugin settings.
WordPress/EventON plugin capability check for 'eventon_import_settings' ajax action = add required capability check (deny unauthenticated/unauthorized requests)
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6180?
CVE-2024-6180 has a severity rating that allows unauthenticated attackers to modify plugin settings, indicating a significant security risk.
How do I fix CVE-2024-6180?
To fix CVE-2024-6180, update the EventON plugin to version 2.2.16 or higher.
Which versions of EventON are affected by CVE-2024-6180?
CVE-2024-6180 affects all versions of the EventON plugin up to and including version 2.2.15.
Can unauthenticated users exploit CVE-2024-6180?
Yes, unauthenticated users can exploit CVE-2024-6180 to modify settings without proper authorization.
What action is missing in CVE-2024-6180 that leads to vulnerability?
CVE-2024-6180 is vulnerable due to a missing capability check on the 'eventon_import_settings' ajax action.