CVE-2024-8476

The Easy PayPal Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the wpeevent_plugin_buttons() function. This makes it possible for unauthenticated attackers to delete arbitrary posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Configurations

Configuration 1 (hide)

cpe:2.3:a:wpplugin:easy_paypal_events:*:*:*:*:*:wordpress:*:*

History

02 Oct 2024, 17:31

Type Values Removed Values Added
First Time Wpplugin
Wpplugin easy Paypal Events
References () https://plugins.trac.wordpress.org/browser/easy-paypal-events-tickets/tags/1.2.1/includes/private_buttons.php#L273 - () https://plugins.trac.wordpress.org/browser/easy-paypal-events-tickets/tags/1.2.1/includes/private_buttons.php#L273 - Product
References () https://plugins.trac.wordpress.org/browser/easy-paypal-events-tickets/tags/1.2.1/includes/private_buttons.php#L5 - () https://plugins.trac.wordpress.org/browser/easy-paypal-events-tickets/tags/1.2.1/includes/private_buttons.php#L5 - Product
References () https://plugins.trac.wordpress.org/changeset/3155809/easy-paypal-events-tickets/trunk/includes/private_buttons.php - () https://plugins.trac.wordpress.org/changeset/3155809/easy-paypal-events-tickets/trunk/includes/private_buttons.php - Patch
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/602d337e-0778-4182-8e77-0eb3b37d5a7a?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/602d337e-0778-4182-8e77-0eb3b37d5a7a?source=cve - Third Party Advisory
CPE cpe:2.3:a:wpplugin:easy_paypal_events:*:*:*:*:*:wordpress:*:*

26 Sep 2024, 13:32

Type Values Removed Values Added
New CVE

Information

Published : 2024-09-25 03:15

Updated : 2024-10-02 17:31


NVD link : CVE-2024-8476

Mitre link : CVE-2024-8476

CVE.ORG link : CVE-2024-8476


JSON object : View

Products Affected

wpplugin

  • easy_paypal_events
CWE
CWE-352

Cross-Site Request Forgery (CSRF)