Mobile Events Manager
Monthly
Unauthenticated permanent deletion of arbitrary WordPress content is possible in sites running the MDJM Event Management plugin (before 1.7.8.5) or Mobile Events Manager plugin (through 1.4.8.3). Both plugins expose a playlist entry removal endpoint that performs no capability check, nonce validation, or post-type verification before permanently deleting the post identified in the request, bypassing the WordPress trash mechanism. A publicly available proof-of-concept exploit reported by WPScan makes this trivially exploitable against any affected installation, with irreversible content destruction as the outcome.
The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated permanent deletion of arbitrary WordPress content is possible in sites running the MDJM Event Management plugin (before 1.7.8.5) or Mobile Events Manager plugin (through 1.4.8.3). Both plugins expose a playlist entry removal endpoint that performs no capability check, nonce validation, or post-type verification before permanently deleting the post identified in the request, bypassing the WordPress trash mechanism. A publicly available proof-of-concept exploit reported by WPScan makes this trivially exploitable against any affected installation, with irreversible content destruction as the outcome.
The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.