CVE-2023-0404

The Events Made Easy plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions related to AJAX actions in versions up to, and including, 2.3.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke those functions intended for administrator use. While the plugin is still pending review from the WordPress repository, site owners can download a copy of the patched version directly from the developer's Github at https://github.com/liedekef/events-made-easy

• CWE-862
• CWE-862

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2836308%40events-made-easy&new=2836308%40events-made-easy&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5a9e62de-3e70-424f-b8e5-2a5f07ca182d?source=cve
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2836308%40events-made-easy&new=2836308%40events-made-easy&sfp_email=&sfph_mail=Patch, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5a9e62de-3e70-424f-b8e5-2a5f07ca182dThird Party Advisory

Published

Jan 19, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-0398Cross-Site Request Forgery (CSRF) in GitHub repository modob…6.5
• CVE-2023-0399The Image Over Image For WPBakery Page Builder WordPress plu…5.4
• CVE-2023-0400 The protection bypass vulnerability in DLP for Windows 11.9…8.2
• CVE-2023-0401A NULL pointer can be dereferenced when signatures are being…7.5
• CVE-2023-0402The Social Warfare plugin for WordPress is vulnerable to aut…5.4
• CVE-2023-0403The Social Warfare plugin for WordPress is vulnerable to Cro…5.4
• CVE-2023-0405The GPT AI Power: Content Writer & ChatGPT & Image Generator…4.3
• CVE-2023-0406Cross-Site Request Forgery (CSRF) in GitHub repository modob…4.3
• CVE-2023-0410Cross-site Scripting (XSS) - Generic in GitHub repository bu…6.1
• CVE-2023-0411Excessive loops in multiple dissectors in Wireshark 4.0.0 to…6.5
• CVE-2023-0412TIPC dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 t…7.1
• CVE-2023-0413Dissection engine bug in Wireshark 4.0.0 to 4.0.2 and 3.6.0 …6.5