Authored by Miguel Santareno

WordPress EventON Calendar plugin version 4.4 suffers from an insecure direct object reference vulnerability.

advisories | CVE-2023-2796

# Exploit Title: WordPress Plugin EventON Calendar 4.4 - Unauthenticated Event Access
# Date: 03.08.2023
# Exploit Author: Miguel Santareno
# Vendor Homepage:
# Version: 4.4
# Tested on: Google and Firefox latest version
# CVE : CVE-2023-2796

# 1. Description
The plugin lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id.

# 2. Proof of Concept (PoC)
Proof of Concept: