The QR code modal handler ran without a nonce check or a per-post capability check, so a subscriber could read and alter QR code data for events they cannot edit, including drafts. It now verifies the request nonce and requires edit_post on the target event.

This vulnerability affects the following application versions:

  • The Events Calendar 6.13.0
  • The Events Calendar 6.13.1
  • The Events Calendar 6.13.2.1
  • The Events Calendar 6.14.0
  • The Events Calendar 6.14.1
  • The Events Calendar 6.14.2
  • The Events Calendar 6.15.0
  • The Events Calendar 6.15.0.1
  • The Events Calendar 6.15.1
  • The Events Calendar 6.15.1.1
  • The Events Calendar 6.15.2
  • The Events Calendar 6.15.3
  • The Events Calendar 6.15.4
  • The Events Calendar 6.15.5
  • The Events Calendar 6.15.6
  • The Events Calendar 6.15.7
  • The Events Calendar 6.15.8
  • The Events Calendar 6.15.9

Skriv et svar

Din e-mailadresse vil ikke blive publiceret. Krævede felter er markeret med *