Description
The EventPrime WordPress plugin before 3.3.6 lacks authentication and authorization, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id/event name.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | EventPrime | < 3.3.6 | 3.3.6 |
References
- https://wpscan.com/vulnerability/e366881c-d21e-4063-a945-95e6b080a373/ exploit vdb-entry technical-description