WordPress Plugin Vulnerabilities

Community Events < 1.5 - Event Deletion via CSRF

Description

The plugin does not have CSRF check in place when deleting events, which could allow attackers to make a logged in admin delete arbitrary events via a CSRF attack

Proof of Concept

Affects Plugins

Plugin icon
community-events
Fixed in 1.5

References

CVE
CVE-2024-6271

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Bob Matyas
Submitter
Bob Matyas
Submitter website
https://www.bobmatyas.com
Submitter twitter
bobmatyas
Verified
Yes
WPVDB ID
44d9d085-34cb-490f-a3f5-f9eafae85ab8

Timeline

Publicly Published
2024-07-01 (about 1 year ago)
Added
2024-07-01 (about 1 year ago)
Last Updated
2024-07-01 (about 1 year ago)

Other

Published
Title
Published
2025-01-16
Title
MemeOne <= 2.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2014-08-01
Title
Amplus - CSRF
Published
2025-05-07
Title
Product Quantity Dropdown For Woocommerce < 1.3 - Cross-Site Request Forgery
Published
2025-12-01
Title
Photo Gallery by Ays < 6.4.9 - Cross-Site Request Forgery to Bulk Actions
Published
2023-12-27
Title
Split Test For Elementor < 1.7.0 - Cross-Site Request Forgery