Eventin Plugin Schedule Record Modification Vulnerability

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the Eventin WordPress plugin before version 4.1.21. It allows users with Contributor-level access or higher to modify or delete schedule entries created by other users without verifying ownership.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Eventin plugin version is below 4.1.21. Log in as a Contributor-level user and attempt to modify or delete schedule entries created by other users. If successful, the vulnerability exists.

Useful 0 Not Useful 0

Impact Analysis

If you use the Eventin plugin with a vulnerable version, unauthorized users could alter or delete schedule entries, potentially disrupting event management or causing data loss.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized modifications or deletions of schedule data, potentially violating integrity requirements in GDPR or HIPAA if such data is considered protected.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Eventin plugin to version 4.1.21 or later. If updating is not possible, consider disabling the plugin until the update is applied.

Useful 0 Not Useful 0