What’s Vulnerable › Vulnerabilities

CVE-2024-3756: MF Gig Calendar <= 1.2.1 - Arbitrary Event Deletion via CSRF

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-05-06 · updated 2026-06-17
• Weakness: CWE-352

Description

The MF Gig Calendar WordPress plugin through 1.2.1 does not have CSRF checks in some places, which could allow attackers to make logged in Contributors and above delete arbitrary events via a CSRF attack

Affected products

• Matthew Fries MF Gig Calendar: through 1.2.1

References

• https://wpscan.com/vulnerability/b28d0dca-2df1-4925-be81-dd9c46859c38/
• https://wpscan.com/vulnerability/b28d0dca-2df1-4925-be81-dd9c46859c38/

Get alerted when CVE-2024-3756 or the next vulnerability affects your stack