CVE-2024-1123

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_frontend_event_submission() function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the title and content of arbitrary posts. This can also be exploited by unauthenticated attackers when the allow_submission_by_anonymous_user setting is enabled.

• CWE-862
• CWE-862

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3033882%40eventprime-event-calendar-management&new=3033882%40eventprime-event-calendar-management&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/351926d4-a9be-4fbd-bdf2-8bbff41d97ef?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3033882%40eventprime-event-calendar-management&new=3033882%40eventprime-event-calendar-management&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/351926d4-a9be-4fbd-bdf2-8bbff41d97ef?source=cveThird Party Advisory

Published

Mar 9, 2024

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-11224The Parallax Image plugin for WordPress is vulnerable to Sto…6.4
• CVE-2024-11225The Premium Packages – Sell Digital Products Securely plugin…6.1
• CVE-2024-11226The FireCask Like & Share Button plugin for WordPress is vul…6.4
• CVE-2024-11227The Memberlite Shortcodes plugin for WordPress is vulnerable…6.4
• CVE-2024-11228The 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 plugin for WordPress is vul…6.4
• CVE-2024-11229The 코드엠샵 소셜톡 plugin for WordPress is vulnerable to Stored Cr…6.4
• CVE-2024-11230The Elementor Header & Footer Builder plugin for WordPress i…5.4
• CVE-2024-11231The 우커머스 네이버페이 plugin for WordPress is vulnerable to Stored …6.4
• CVE-2024-11233In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.…8.2
• CVE-2024-11234In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.…7.2
• CVE-2024-11235In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, …8.1
• CVE-2024-11236In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.…9.8