title: EventON < 2.1.2 - Unauthenticated Event Access
description: The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id.
problem types: CWE-862 Missing Authorization
affected:
{
vendor: Unknown
product: EventON
versions:
status: affected, versionType: custom, version: 0, lessThan: 2.1.2
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}