What’s Vulnerable › Vulnerabilities

CVE-2023-4251: EventPrime < 3.2.0 - Booking Creation via CSRF

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-10-31 · updated 2026-06-17
• Weakness: CWE-352

Description

The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks.

Affected products

• metagauss EventPrime – Events Calendar, Bookings and Tickets: before 3.2.0 — fixed in 3.2.0

How to fix

Upgrade to a fixed version: metagauss EventPrime – Events Calendar, Bookings and Tickets 3.2.0. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/ce564628-3d15-4bc5-8b8e-60b71786ac19
• https://wpscan.com/vulnerability/ce564628-3d15-4bc5-8b8e-60b71786ac19

Get alerted when CVE-2023-4251 or the next vulnerability affects your stack