CVE-2023-2796: Myeventon Eventon

Medium severity, CVSS 5.3. EPSS: 42.7% chance of exploitation in the next 30 days.

The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id.

Affected products

• Myeventon Eventon: before 2.1.2 (fixed in 2.1.2)

Published 2023-07-10. Last modified 2026-06-17.