CVE-2023-2796

MEDIUM EXPLOITED NUCLEI

Eventon < 2.1.2 - Missing Authorization

Title source: rule

Description

The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id.

Exploits (1)

exploitdb WORKING POC

by Miguel Santareno · textwebappsphp

https://www.exploit-db.com/exploits/51658

View Code ZIP pw:eip

Nuclei Templates (1)

EventON <= 2.1 - Missing Authorization

MEDIUMVERIFIEDby randomrobbie

Shodan: vuln:CVE-2023-2796 || http.html:/wp-content/plugins/eventon-lite/ || http.html:/wp-content/plugins/eventon/

FOFA: wp-content/plugins/eventon/ || body=/wp-content/plugins/eventon/ || body=/wp-content/plugins/eventon-lite/

References (2)

[Exploit, Third Party Advisory] https://wpscan.com/vulnerability/e9ef793c-e5a3-4c55-beee-56b0909f7a0d

[Exploit, Third Party Advisory] http://packetstormsecurity.com/files/173984/WordPress-EventON-Calendar-4.4-Insecure-Direct-Object-Reference.html

Scores

CVSS v3 5.3

EPSS 0.7155

EPSS Percentile 98.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

VulnCheck KEV 2024-01-22

CWE

CWE-862

Status published

Products (1)

myeventon/eventon < 2.1.2

Published Jul 10, 2023

Tracked Since Feb 18, 2026