CVE-2024-3756 - MF Gig Calendar <= 1.2.1 - Arbitrary Event Deletion via CSRF

Back Back to CVE browser

HIGH

MF Gig Calendar <= 1.2.1 - Arbitrary Event Deletion via CSRF

Published May 6, 2024

7.5

HIGH

CVSS 3.1

EPSS 0.32%

Description

The MF Gig Calendar WordPress plugin through 1.2.1 does not have CSRF checks in some places, which could allow attackers to make logged in Contributors and above delete arbitrary events via a CSRF attack

Affected products

Vendor n/a Product MF Gig Calendar Default
affected
- Version
  0
  Status
  affected
  Constraints
  <=1.2.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

MF Gig Calendar

affected

Version	Status	Constraints
0	affected	<=1.2.1

Vendor MF Gig Calendar Project Product MF Gig Calendar Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=1.2.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

MF Gig Calendar Project

MF Gig Calendar

n/a

Version	Status	Constraints
0	affected	<=1.2.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-32329
Advisory
https://wpscan.com/vulnerability/b28d0dca-2df1-4925-be81-dd9c46859c38/
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-32329		Advisory
https://wpscan.com/vulnerability/b28d0dca-2df1-4925-be81-dd9c46859c38/		exploitvdb-entrytechnical-descriptionThird Party Advisory