CVE-2022-29434 - WordPress Spiffy Calendar plugin <= 4.9.0 - Edit/Delete event via IDOR vulnerability

Back Back to CVE browser

MEDIUM

WordPress Spiffy Calendar plugin <= 4.9.0 - Edit/Delete event via IDOR vulnerability

Published May 20, 2022

6.3

MEDIUM

CVSS 3.1

EPSS 0.70%

Description

Insecure Direct Object References (IDOR) vulnerability in Spiffy Plugins Spiffy Calendar <= 4.9.0 at WordPress allows an attacker to edit or delete events.

Affected products

Vendor Spiffy Plugins Product Spiffy Calendar Default
n/a
- Version
  <= 4.9.0
  Status
  affected
  Constraints
  <=4.9.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Spiffy Plugins

Spiffy Calendar

n/a

Version	Status	Constraints
<= 4.9.0	affected	<=4.9.0

Remediation

Vendor solution

Update to 4.9.1 or higher version.

Weaknesses (1)

CWE-639

Authorization Bypass

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-33772
Advisory
https://patchstack.com/database/vulnerability/spiffy-calendar/wordpress-spiffy-calendar-plugin-4-9-0-edit-delete-event-via-idor-vulnerability
x_refsource_CONFIRMRelease NotesThird Party Advisory
https://wordpress.org/plugins/spiffy-calendar/#developers
x_refsource_CONFIRMProductRelease Notes

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-33772		Advisory
https://patchstack.com/database/vulnerability/spiffy-calendar/wordpress-spiffy-calendar-plugin-4-9-0-edit-delete-event-via-idor-vulnerability		x_refsource_CONFIRMRelease NotesThird Party Advisory
https://wordpress.org/plugins/spiffy-calendar/#developers		x_refsource_CONFIRMProductRelease Notes