CVE-2024-8700 - Vulnerability Details - OpenCVE

The Event Calendar WordPress plugin through 1.0.4 does not check for authorization on delete actions, allowing unauthenticated users to delete arbitrary calendars.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable yes

Technical Impact partial

Vendors	Products
Total-soft	Event Calendar

Configuration 1 [-]

cpe:2.3:a:total-soft:event_calendar:*:*:*:*:*:wordpress:*:*

No data.

References

Link	Providers
https://wpscan.com/vulnerability/8c48b657-afa1-45e6-ada6-27ee58185143/

History

Wed, 04 Jun 2025 20:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Total-soft Total-soft event Calendar
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:total-soft:event_calendar::::::wordpress::*
Vendors & Products		Total-soft Total-soft event Calendar

Tue, 20 May 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 15 May 2025 20:15:00 +0000

Type	Values Removed	Values Added
Description		The Event Calendar WordPress plugin through 1.0.4 does not check for authorization on delete actions, allowing unauthenticated users to delete arbitrary calendars.
Title		Event Calendar <= 1.0.4 - Unauthenticated Arbitrary Calendar Deletion
References		https://wpscan.com/vulnerability/8c48b657-afa1-45e6-ada6-27ee58185143/

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2025-05-15T20:07:17.831Z

Updated: 2025-05-20T19:12:51.900Z

Reserved: 2024-09-11T13:54:25.239Z

Link: CVE-2024-8700

Vulnrichment

Updated: 2025-05-19T20:23:57.221Z

NVD

Status : Analyzed

Published: 2025-05-15T20:15:59.547

Modified: 2025-06-04T20:07:46.120

Link: CVE-2024-8700

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-8700", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2024-09-11T13:54:25.239Z", "datePublished": "2025-05-15T20:07:17.831Z", "dateUpdated": "2025-05-20T19:12:51.900Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2025-05-15T20:07:17.831Z"}, "title": "Event Calendar <= 1.0.4 - Unauthenticated Arbitrary Calendar Deletion", "problemTypes": [{"descriptions": [{"description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Event Calendar", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThanOrEqual": "1.0.4"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "The Event Calendar WordPress plugin through 1.0.4 does not check for authorization on delete actions, allowing unauthenticated users to delete arbitrary calendars."}], "references": [{"url": "https://wpscan.com/vulnerability/8c48b657-afa1-45e6-ada6-27ee58185143/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Bob Matyas", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"references": [{"url": "https://wpscan.com/vulnerability/8c48b657-afa1-45e6-ada6-27ee58185143/", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-05-20T18:38:11.110067Z", "id": "CVE-2024-8700", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-20T19:12:51.900Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-8700", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-20T18:38:11.110067Z"}}}], "references": [{"url": "https://wpscan.com/vulnerability/8c48b657-afa1-45e6-ada6-27ee58185143/", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-19T20:23:57.221Z"}}], "cna": {"title": "Event Calendar <= 1.0.4 - Unauthenticated Arbitrary Calendar Deletion", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Bob Matyas"}, {"lang": "en", "type": "coordinator", "value": "WPScan"}], "affected": [{"vendor": "Unknown", "product": "Event Calendar", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.4"}], "defaultStatus": "affected"}], "references": [{"url": "https://wpscan.com/vulnerability/8c48b657-afa1-45e6-ada6-27ee58185143/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "x_generator": {"engine": "WPScan CVE Generator"}, "descriptions": [{"lang": "en", "value": "The Event Calendar WordPress plugin through 1.0.4 does not check for authorization on delete actions, allowing unauthenticated users to delete arbitrary calendars."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2025-05-15T20:07:17.831Z"}}}, "cveMetadata": {"cveId": "CVE-2024-8700", "state": "PUBLISHED", "dateUpdated": "2025-05-20T19:12:51.900Z", "dateReserved": "2024-09-11T13:54:25.239Z", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "datePublished": "2025-05-15T20:07:17.831Z", "assignerShortName": "WPScan"}, "dataVersion": "5.1"}