Threats tagged 'ghsa-fw4x-rfrx-9g6f'

The Events Made Easy WordPress plugin before version 3.1.4 contains an authorization bypass vulnerability. It does not verify that the requester is authorized to modify a targeted record when processing unauthenticated data-change requests. The plugin relies solely on a public nonce without per-record tokens or ownership checks, allowing unauthenticated attackers to overwrite personal data of any person record. This vulnerability has a medium severity rating with a CVSS score of 5.3.