Eventprime
CVE-2023-4252
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
1DescriptionNVD
The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an attacker to purchase bookings without payment.
AnalysisAI
The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an attacker to purchase bookings without payment. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an attacker to purchase bookings without payment. Affected products include: Metagauss Eventprime. Version information: through 3.2.9.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Eventprime
View allThe EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing use
The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the p
The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in
This is a PHP Object Injection vulnerability in the Metagauss EventPrime WordPress plugin (eventprime-event-calendar-man
Missing Authorization vulnerability in Metagauss EventPrime.3.4. Rated critical severity (CVSS 9.8), this vulnerability
PHP Object Injection in the EventPrime event-calendar-management WordPress plugin (versions 4.3.4.1 and earlier) allows
Missing Authorization vulnerability in EventPrime Events EventPrime allows Exploiting Incorrectly Configured Access Cont
The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attacke
The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attacke
Missing Authorization vulnerability in Metagauss EventPrime.3.9. Rated high severity (CVSS 8.2), this vulnerability is r
Unauthenticated PHP Object Injection in the EventPrime event calendar plugin for WordPress (versions <= 4.3.2.1) allows
EventPrime versions through 4.2.8.3 contain an authorization bypass vulnerability that allows unauthenticated remote att
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today