Medium severity5.3NVD Advisory· Published Jul 10, 2023· Updated Jun 17, 2026

CVE-2023-3219

Description

The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Eventoncpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <2.1.2
Package: https://wordpress.org/plugins/eventon

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/72d80887-0270-4987-9739-95b1a178c1fdnvdExploitThird Party Advisory
packetstormsecurity.com/files/173992/WordPress-EventON-Calendar-4.4-Insecure-Direct-Object-Reference.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.005
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000