CVE-2024-1124 in EventPrime Plugin
요약
\~에 의해 MITRE • 2024. 03. 09.
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the ep_send_attendees_email() function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to send arbitrary emails with arbitrary content from the site.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.