CVE-2024-1123

Summary

CVE-2024-1123 is a vulnerability affecting the EventPrime plugin for WordPress. The issue lies in the save_frontend_event_submission() function, which lacks sufficient capability checks. This enables authenticated attackers with subscriber-level access or higher to manipulate data, including titles and content of arbitrary posts. Unauthenticated attacks are possible when the allow_submission_by_anonymous_user setting is enabled, allowing unauthorized modification of data. Versions up to and including 3.4.2 are vulnerable to this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.