Vulnerabilities > CVE-2023-0404 - Missing Authorization vulnerability in E-Dynamics Events Made Easy

CVSS 5.4 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

LOW

Integrity impact

LOW

Availability impact

NONE

network

low complexity

e-dynamics

CWE-862

NVD

Published: 2023-01-19

Updated: 2024-11-21

Summary

The Events Made Easy plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions related to AJAX actions in versions up to, and including, 2.3.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke those functions intended for administrator use. While the plugin is still pending review from the WordPress repository, site owners can download a copy of the patched version directly from the developer's Github at https://github.com/liedekef/events-made-easy

Vulnerable Configurations

Part	Description	Count
Application	E-Dynamics E Dynamics Events Made Easy - E Dynamics Events Made Easy 2.1.100 E Dynamics Events Made Easy 2.1.101 E Dynamics Events Made Easy 2.1.102 E Dynamics Events Made Easy 2.1.103 E Dynamics Events Made Easy 2.1.104 E Dynamics Events Made Easy 2.1.105 E Dynamics Events Made Easy 2.1.106 E Dynamics Events Made Easy 2.1.107 E Dynamics Events Made Easy 2.1.108 E Dynamics Events Made Easy 2.1.109 E Dynamics Events Made Easy 2.1.110 E Dynamics Events Made Easy 2.1.111 E Dynamics Events Made Easy 2.1.112 E Dynamics Events Made Easy 2.1.113 E Dynamics Events Made Easy 2.1.114 E Dynamics Events Made Easy 2.1.115 E Dynamics Events Made Easy 2.1.116 E Dynamics Events Made Easy 2.1.117 E Dynamics Events Made Easy 2.1.118 E Dynamics Events Made Easy 2.1.119 E Dynamics Events Made Easy 2.1.120 E Dynamics Events Made Easy 2.1.121 E Dynamics Events Made Easy 2.1.122 E Dynamics Events Made Easy 2.2.0 E Dynamics Events Made Easy 2.2.1 E Dynamics Events Made Easy 2.2.2 E Dynamics Events Made Easy 2.2.3 E Dynamics Events Made Easy 2.2.4 E Dynamics Events Made Easy 2.2.5 E Dynamics Events Made Easy 2.2.6 E Dynamics Events Made Easy 2.2.7 E Dynamics Events Made Easy 2.2.8 E Dynamics Events Made Easy 2.2.9 E Dynamics Events Made Easy 2.2.10 E Dynamics Events Made Easy 2.2.11 E Dynamics Events Made Easy 2.2.12 E Dynamics Events Made Easy 2.2.13 E Dynamics Events Made Easy 2.2.14 E Dynamics Events Made Easy 2.2.15 E Dynamics Events Made Easy 2.2.16 E Dynamics Events Made Easy 2.2.17 E Dynamics Events Made Easy 2.2.18 E Dynamics Events Made Easy 2.2.19 E Dynamics Events Made Easy 2.2.20 E Dynamics Events Made Easy 2.2.21 E Dynamics Events Made Easy 2.2.22 E Dynamics Events Made Easy 2.2.23 E Dynamics Events Made Easy 2.2.24 E Dynamics Events Made Easy 2.2.25 E Dynamics Events Made Easy 2.2.26 E Dynamics Events Made Easy 2.2.27 E Dynamics Events Made Easy 2.2.28 E Dynamics Events Made Easy 2.2.29 E Dynamics Events Made Easy 2.2.30 E Dynamics Events Made Easy 2.2.31 E Dynamics Events Made Easy 2.2.32 E Dynamics Events Made Easy 2.2.33 E Dynamics Events Made Easy 2.2.34 E Dynamics Events Made Easy 2.2.35 E Dynamics Events Made Easy 2.2.36 E Dynamics Events Made Easy 2.2.37 E Dynamics Events Made Easy 2.2.38 E Dynamics Events Made Easy 2.2.39 E Dynamics Events Made Easy 2.2.40 E Dynamics Events Made Easy 2.2.41 E Dynamics Events Made Easy 2.2.42 E Dynamics Events Made Easy 2.2.43 E Dynamics Events Made Easy 2.2.44 E Dynamics Events Made Easy 2.2.45 E Dynamics Events Made Easy 2.2.46 E Dynamics Events Made Easy 2.2.99 E Dynamics Events Made Easy 2.3.0 E Dynamics Events Made Easy 2.3.1 E Dynamics Events Made Easy 2.3.2 E Dynamics Events Made Easy 2.3.3 E Dynamics Events Made Easy 2.3.4 E Dynamics Events Made Easy 2.3.5 E Dynamics Events Made Easy 2.3.6 E Dynamics Events Made Easy 2.3.7 E Dynamics Events Made Easy 2.3.8 E Dynamics Events Made Easy 2.3.9 E Dynamics Events Made Easy 2.3.10 E Dynamics Events Made Easy 2.3.11 E Dynamics Events Made Easy 2.3.12 E Dynamics Events Made Easy 2.3.13 E Dynamics Events Made Easy 2.3.14 E Dynamics Events Made Easy 2.3.16	88

Common Weakness Enumeration (CWE)

CWE-862 - Missing Authorization

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References