Event Manager and Tickets Selling Plugin for WooCommerce < 3.5.3 - Arbitrary Settings Change
2021-11-03 00:00
WPScanTeamStrategic Overview
StatusPatched in 3.5.3
Affected PluginEvent Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
Affected Version
< 3.5.3CVSS6.5Medium
CVE
N/AVulnerability Overview
The Event Manager and Tickets Selling Plugin for WooCommerce plugin for WordPress is vulnerable to arbitrary settings reset via the mep_wl_ajax_license_activate and mep_wl_ajax_license_deactivate functions in versions before 3.5.3. This is due to a missing capabilities check on these functions. This makes it possible for unauthenticated attackers to arbitrarily modify plugin settings.
Technical Analysis
REMEDIATION: Update to version 3.5.3, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C