Medium severity · published Oct 31, 2023
CVE-2023-4251
EventPrime < 3.2.0 - Booking Creation via CSRF
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EV
EventPrime ·
before 3.2.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-4251
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-4251
Exploit
https://wpscan.com/vulnerability/ce564628-3d15-4bc5-8b8e-60b71786ac19
More from EventPrime
6.4
CVE-2024-4665
EventPrime – Events Calendar, Bookings and Tickets < 3.5.0 - Subscriber+ Arbitrary booking settings update
6.1
CVE-2023-4250
EventPrime < 3.2.0 - Reflected XSS
6.1
CVE-2023-5238
EventPrime < 3.2.0 - Reflected HTML Injection on keyword parameter
5.3
CVE-2023-6447
EventPrime < 3.3.6 - Unauthenticated Event Access
5.3
CVE-2023-4252
EventPrime <= 3.2.9 - Booking Pricing Bypass