EventON, CVE-2023-3219

CVE, Research URL: CVE-2023-3219
Home page URL: Security reports for EventON
Application: EventON
Published on: Jul 10, 2023
Research Description: The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.
Affected versions: Min -, max 2.1.2.
Status: vulnerable