CVE-2023-3219 EventON < 2.1.2 - Unauthenticated Post Access via IDOR

What is CVE-2023-3219?

CVE-2023-3219 is a medium-severity missing authorization vulnerability in Unknown EventON, published on 10 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.

Weakness: CWE-639

Which versions are affected by CVE-2023-3219?

It affects 1 product.

Products include Myeventon Eventon.

How do I fix CVE-2023-3219?

No fix has been published for CVE-2023-3219 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-3219 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-3219 exists.

Public exploit code: 1 Exploit-DB entry and 1 Nuclei template.

Other vulnerabilities in Unknown EventON

• CVE-2023-6242 Cross-site request forgery in EventON (Pro) - WordPress Virtual Event Calendar Plugin Medium 6.5
• CVE-2023-6244 Cross-site request forgery in EventON (Pro) - WordPress Virtual Event Calendar Plugin Medium 6.5
• CVE-2023-6158 Missing authorization in EventON (Pro) - WordPress Virtual Event Calendar Plugin Medium 6.5
• CVE-2025-3527 Cross-site scripting in EventON (Pro) - WordPress Virtual Event Calendar Plugin Medium 6.4
• CVE-2023-7200 EventON < 4.4.1 - Reflected Cross-Site Scripting Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6ccc-8wgj-7rf9.