Not rated
CVE-2023-4252 The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an…
Description
The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an attacker to purchase bookings without payment.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| EventPrime 3.2 | earliest → 3.2.9 | No fix stated |
References
- wpscan.com wpscan.com
Timeline
- Published
- Last modified
Other CVEs of EventPrime
The 8 CVEs of EventPrime →
CVE-2026-118523
EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status Override
5.3
Medium
CVE-2024-4665
The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing…
6.4
Medium
CVE-2023-6447
The EventPrime WordPress plugin before 3.3.6 lacks authentication and authorization, allowing unauthenticated visitors…
5.3
Medium
CVE-2023-4250
The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in…
6.1
Medium