CVE-2023-4251

MEDIUM

EventPrime < 3.2.0 - Cross-Site Request Forgery via Booking Creation

Title source: llm

Description

The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks.

References (1)

Core 1

Core References

Exploit, Third Party Advisory exploit vdb-entry technical-description

https://wpscan.com/vulnerability/ce564628-3d15-4bc5-8b8e-60b71786ac19

Scores

CVSS v3 4.3

EPSS 0.0023

EPSS Percentile 13.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-352

Status published

Products (1)

metagauss/eventprime < 3.2.0

Published Oct 31, 2023

Tracked Since Feb 18, 2026