CVE-2024-8016: The Events Calendar Pro <= 7.0.2 - Authenticated (Administrator+) PHP Object Injection to Remote Code Execution
The Events Calendar Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.0.2 via deserialization of untrusted input from the 'filters' parameter in widgets. This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely. In certain configurations, this can be exploitable by lower level users. We confirmed that this plugin installed with Elementor makes it possible for users with contributor-level access and above to exploit this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8016?
CVE-2024-8016 is rated as a critical vulnerability due to the potential for PHP Object Injection leading to arbitrary code execution.
Who is affected by CVE-2024-8016?
CVE-2024-8016 affects all versions of The Events Calendar Pro plugin for WordPress up to and including 7.0.2.
How do I fix CVE-2024-8016?
To fix CVE-2024-8016, update The Events Calendar Pro plugin to version 7.0.2.1 or later.
What type of attacks can exploit CVE-2024-8016?
CVE-2024-8016 can be exploited by authenticated attackers with administrator-level access to perform remote code execution.
Is CVE-2024-8016 a known issue in previous updates?
Yes, CVE-2024-8016 is a known issue in previous updates of The Events Calendar Pro plugin, specifically in versions up to 7.0.2.