CVE-2022-3891 - WP FullCalendar < 1.5 - Unauthenticated Arbitrary Post Access

Back Back to CVE browser

MEDIUM

WP FullCalendar < 1.5 - Unauthenticated Arbitrary Post Access

Published Feb 13, 2023

5.3

MEDIUM

CVSS 3.1

EPSS 0.69%

Description

The WP FullCalendar WordPress plugin before 1.5 does not ensure that the post retrieved via an AJAX action is public and can be accessed by the user making the request, allowing unauthenticated attackers to get the content of arbitrary posts, including draft/private as well as password-protected ones.

Affected products

Vendor n/a Product WP FullCalendar Default
unaffected
Affected
- ≥ 0, < 1.5

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	WP FullCalendar	unaffected	Affected ≥ 0, < 1.5

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-43227
Advisory
https://wpscan.com/vulnerability/5a69965d-d243-4d51-b7a4-d6f4b199abf1
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-43227		Advisory
https://wpscan.com/vulnerability/5a69965d-d243-4d51-b7a4-d6f4b199abf1		exploitvdb-entrytechnical-descriptionThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Feb 13, 2023

Updated Mar 21, 2025

Reserved Nov 8, 2022

Link CVE-2022-3891

CISA Vulnrichment

Updated Mar 21, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-3891

Red Hat

No data

ENISA EUVD

Assigner WPScan

Published Feb 13, 2023

Updated Mar 21, 2025

Link EUVD-2022-43227

GitHub

No data