CVE-2024-8700

Description

The Event Calendar WordPress plugin through 1.0.4 does not check for authorization on delete actions, allowing unauthenticated users to delete arbitrary calendars.

Reserved 2024-09-11 | Published 2025-05-15 | Updated 2025-05-20 | Assigner WPScan

Problem types

CWE-284 Improper Access Control

Product status

Default status
affected

Any version
affected

Credits

Bob Matyas finder

WPScan coordinator

References

wpscan.com/...rability/8c48b657-afa1-45e6-ada6-27ee58185143/ exploit vdb-entry technical-description

cve.org (CVE-2024-8700)

nvd.nist.gov (CVE-2024-8700)

Download JSON