title: EventON (Free < 2.2.9, Premium <= 4.5.8) - Unauthenticated Virtual Event Settings Update
description: The EventON WordPress plugin through 4.5.8, EventON WordPress plugin before 2.2.7 do not have authorisation in some AJAX actions, allowing unauthenticated users to update virtual events settings, such as meeting URL, moderator, access details etc
problem types: CWE-862 Missing Authorization
affected:
{
vendor: Unknown
product: EventON Premium
versions:
status: affected, versionType: semver, version: 0, lessThan: 4.5.8
defaultStatus: affected
}
{
vendor: Unknown
product: EventON
versions:
status: affected, versionType: semver, version: 0, lessThan: 2.2.7
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}
