CVE-2023-3219: Myeventon Eventon

Medium severity, CVSS 5.3. EPSS: 7.5% chance of exploitation in the next 30 days.

The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.

Affected products

• Myeventon Eventon: before 2.1.2 (fixed in 2.1.2)

Published 2023-07-10. Last modified 2026-06-17.