title: Spiffy Calendar < 4.9.9 - Broken Access Control
description: The Spiffy Calendar WordPress plugin before 4.9.9 doesn't check the event_author parameter, and allows any user to alter it when creating an event, leading to deceiving users/admins that a page was created by a Contributor+.
problem types: CWE-863 Incorrect Authorization
affected:
{
vendor: Unknown
product: Spiffy Calendar
versions:
status: affected, versionType: semver, version: 0, lessThan: 4.9.9
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}