Eventin <= 4.1.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Schedule Deletion and Modification

The Eventin plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.1.20. This is due to the permission check reading the subject ID from the request body parameter `ids` while the handler read it from the URL parameter `id`, allowing an attacker to authorize against their own schedule and execute against a victim's. This makes it possible for authenticated attackers, with contributor-level access and above, to delete or modify schedules belonging to other users by supplying a victim's schedule ID in the URL path while carrying their own schedule ID in the request body to pass the ownership check.

Because it turns on account access, WordSec's login security is the relevant layer: role-based two-factor, captcha and brute-force limits raise the cost of getting the account this needs. None of that substitutes for the fix: Eventin 4.1.21 closes this, and updating the plugin is the step that ends it.

• Login Security
• Alerts