Event Manager and Tickets Selling Plugin for WooCommerce < 3.5.3 - Missing Authorization
2021-11-03 00:00
WPScanTeamStrategic Overview
StatusPatched in 3.5.3
Affected PluginEvent Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
Affected Version
< 3.5.3CVSS5.3Medium
CVE
N/AVulnerability Overview
The Event Manager and Tickets Selling Plugin for WooCommerce plugin for WordPress is vulnerable to arbitrary template import in versions before 3.5.3 via the mep_import_ajax_template function. This is due to a missing capability check on this function. This makes it possible for unauthenticated attackers to arbitrarily import Elementor templates to the site.
Technical Analysis
REMEDIATION: Update to version 3.5.3, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C