CVE-2022-3336 Event Monster < 1.2.0 - Visitors Deletion via CSRF
Attackers can force logged-in admins to delete arbitrary visitors in the Event Monster WordPress plugin due to missing CSRF checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-3336?
CVE-2022-3336 is a medium-severity vulnerability in Unknown Event Monster, published on 21 Nov 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Event Monster WordPress plugin before 1.2.0 does not have CSRF check when deleting visitors, which could allow attackers to make logged in admin delete arbitrary visitors via a CSRF attack
Which versions are affected by CVE-2022-3336?
It affects 1 product.
Products include Awplife Event Monster.
How do I fix CVE-2022-3336?
No fix has been published for CVE-2022-3336 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-3336 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-3336 exists.
Other vulnerabilities in Unknown Event Monster
- CVE-2024-1895 Event Monster <= 1.3.9 - Authenticated(Contributor+) PHP Object Injection via Custom Meta
- CVE-2022-3720 Event Monster < 1.2.1 - Admin+ SQLi
- CVE-2023-47525 WordPress Event Management Tickets Booking Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-11396 Event monster <= 1.4.3 - Information Exposure Via Visitors List Export
- CVE-2024-5059 WordPress Event Monster Plugin <= 1.4.0 - Sensitive Data Exposure vulnerability
Sources
Also known as GHSA-7mhf-hm4m-p9w6.