Event post, CVE-2024-1376

CVE, Research URL: CVE-2024-1376
Home page URL: Security reports for Event post
Application: Event post
Published on: May 24, 2024
Research Description: The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing capability check on the save_bulkdatas function in all versions up to, and including, 5.9.4. This makes it possible for authenticated attackers, with subscriber access or higher, to update post_meta_data.
Affected versions: Min -, max 5.9.5.
Status: vulnerable