WordPress Community Events Plugin Missing Authorization Vulnerability in Event Approval Function

A vulnerability exists in the Community Events plugin for WordPress, allowing unauthorized data modification. This issue arises from a lack of capability checks in the 'ajax_admin_event_approval' function, present in all versions up to and including 1.5.6. As a result, unauthenticated attackers can approve arbitrary events by manipulating the 'eventlist' parameter.

Impact

Exploitation of this vulnerability allows for unauthorized approval of events, potentially leading to misuse of event management features.

Reproduction

To reproduce this vulnerability, send a request to the 'ajax_admin_event_approval' endpoint without proper authorization. Include the 'eventlist' parameter with the IDs of the events to be approved. The absence of a capability check allows this action to be performed by unauthenticated users.

Remediation

Update the Community Events plugin to version 1.5.7 or a newer patched version.