title: Event Calendar < 1.1.51 - Subscriber+ Event Creation
description: The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, allowing users with a role as low as subscriber to create events
problem types: CWE-352 Cross-Site Request Forgery (CSRF)
affected:
{
vendor: Unknown
product: EventCalendar
versions:
version: 1.1.51, status: affected, lessThan: 1.1.51, versionType: custom
}