Eventin <= 4.1.20 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Event Modification, Deletion and Ownership Takeover

The Eventin plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.1.20. This is due to a mismatch between the parameter read during authorization (body `ids`) and the parameter read during execution (URL `id`), allowing a body-supplied `ids` value to satisfy the ownership check while the handler operated on a different, attacker-chosen resource. This makes it possible for authenticated attackers, with contributor-level access and above, to modify, delete, or take ownership of arbitrary events belonging to other users by supplying their own resource ID in the request body while targeting a victim's resource ID in the URL path.

Because it turns on account access, WordSec's login security is the relevant layer: role-based two-factor, captcha and brute-force limits raise the cost of getting the account this needs. None of that substitutes for the fix: Eventin 4.1.21 closes this, and updating the plugin is the step that ends it.

• Login Security
• Alerts