Medium severity · published Nov 21, 2022
CVE-2022-3336
The Event Monster WordPress plugin before 1.2.0 does not have CSRF check when deleting visitors, which could allow attackers to make logged in admin delete arbitrary visitors via…
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
The Event Monster WordPress plugin before 1.2.0 does not have CSRF check when deleting visitors, which could allow attackers to make logged in admin delete arbitrary visitors via a CSRF attack
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
Event Monster · Awplife
before 1.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-3336
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-3336
Exploit
https://wpscan.com/vulnerability/57bc6633-1aeb-4c20-a2a5-9b3fa10ba95d
More from Event Monster
7.5
CVE-2024-5059
WordPress Event Monster Plugin <= 1.4.0 - Sensitive Data Exposure vulnerability
7.5
CVE-2024-1895
Event Monster <= 1.3.9 - Authenticated(Contributor+) PHP Object Injection via Custom Meta
7.2
CVE-2022-3720
The Event Monster WordPress plugin before 1.2.0 does not validate and escape some parameters before using them in SQL statements, which could lead to SQL Injection exploitable by…
5.4
CVE-2023-47525
WordPress Event Management Tickets Booking Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)
5.3
CVE-2024-11396
Event monster <= 1.4.3 - Information Exposure Via Visitors List Export