9.1

CVE-2024-8016

The Events Calendar Pro <= 7.0.2 - Authenticated (Administrator+) PHP Object Injection to Remote Code Execution

The Events Calendar Pro <= 7.0.2 - Authenticated (Administrator+) PHP Object Injection to Remote Code Execution

The Events Calendar Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.0.2 via deserialization of untrusted input from the 'filters' parameter in widgets. This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely. In certain configurations, this can be exploitable by lower level users. We confirmed that this plugin installed with Elementor makes it possible for users with contributor-level access and above to exploit this issue.
Mögliche Gegenmaßnahme
The Events Calendar Pro: Update to version 7.0.2.1, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Theeventscalendar ≫ Events Calendar Pro SwPlatformwordpress Version < 7.0.2.1
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt The Events Calendar Pro
Version *-7.0.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.75% 0.5
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
security@wordfence.com 9.1 2.3 6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://theeventscalendar.com/blog/news/important-security-update-for-the-events-calendar-pro/
Vendor Advisory
https://theeventscalendar.com/release-notes/events-calendar-pro/events-calendar-pro-7-0-2-1/
Release Notes
https://www.wordfence.com/threat-intel/vulnerabilities/id/34f0e5a6-0bd3-4734-b7e0-27dc825d193f?source=cve
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/34f0e5a6-0bd3-4734-b7e0-27dc825d193f
Third Party Advisory