CVE-2024-3756

Published: May 6, 2024Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.6 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The MF Gig Calendar WordPress plugin through 1.2.1 does not have CSRF checks in some places, which could allow attackers to make logged in Contributors and above delete arbitrary events via a CSRF attack

Affected (1)

Products: Mf Gig Calendar Project: Mf Gig Calendar

Mf Gig Calendar Project

1 product

Mf Gig Calendar

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mf Gig Calendar Project Mf Gig Calendar	Up to 1.2.1

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (2)

https://wpscan.com/vulnerability/b28d0dca-2df1-4925-be81-dd9c46859c38/

Source: contact@wpscan.com

ExploitThird Party Advisory

https://wpscan.com/vulnerability/b28d0dca-2df1-4925-be81-dd9c46859c38/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.