CVE-2024-0855 — Spiffy Calendar < 4.9.9 - Broken Access Control
The Spiffy Calendar WordPress plugin before 4.9.9 doesn't check the event_author parameter, and allows any user to alter it when creating an event, leading to deceiving users/ad…
Published: 2024-02-27 · CVSS: 5.3 · CVSS 3.1
The Spiffy Calendar WordPress plugin before 4.9.9 doesn't check the event_author parameter, and allows any user to alter it when creating an event, leading to deceiving users/admins that a page was created by a Contributor+.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7