CVE-2023-2796

MEDIUM EXPLOITED NUCLEI

EventON < 2.1.2 - Unauthenticated Insecure Direct Object Reference via eventon_ics_download AJAX Action

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2023-2796 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including Miguel Santareno. A Nuclei detection template is also available.

AI-analyzed exploit summary This exploit demonstrates an unauthenticated information disclosure vulnerability in the EventON Calendar WordPress plugin. By manipulating the 'event_id' parameter in an AJAX request, attackers can access private or password-protected events without authentication.

Description

The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id.

Exploits (1)

exploitdb WORKING POC
by Miguel Santareno · textwebappsphp
https://www.exploit-db.com/exploits/51658

This exploit demonstrates an unauthenticated information disclosure vulnerability in the EventON Calendar WordPress plugin. By manipulating the 'event_id' parameter in an AJAX request, attackers can access private or password-protected events without authentication.

Classification
Working Poc 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: WordPress Plugin EventON Calendar 4.4
No auth needed
Prerequisites: Knowledge of the target WordPress site URL · Valid event_id values
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

EventON <= 2.1 - Missing Authorization
MEDIUMVERIFIEDby randomrobbie
Shodan: vuln:CVE-2023-2796 || http.html:/wp-content/plugins/eventon-lite/ || http.html:/wp-content/plugins/eventon/
FOFA: wp-content/plugins/eventon/ || body=/wp-content/plugins/eventon/ || body=/wp-content/plugins/eventon-lite/

References (2)

Core 2

Scores

CVSS v3 5.3
EPSS 0.7230
EPSS Percentile 98.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

VulnCheck KEV 2024-01-22
CWE
CWE-862
Status published
Products (1)
myeventon/eventon < 2.1.2
Published Jul 10, 2023
Tracked Since Feb 18, 2026