Description
WordPress Plugin Events Widgets For Elementor And The Events Calendar is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently download and extract a remote ZIP file on the blog, which can lead to remote code execution. WordPress Plugin Events Widgets For Elementor And The Events Calendar version 1.4.3 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 1.5 or latest
References
Related Vulnerabilities
WordPress Plugin WP to Twitter Security Bypass (3.2.19)
WordPress Plugin WP REST API (WP API) Cross-Site Scripting (1.2.2)
WordPress Plugin iMember360 Multiple Vulnerabilities (3.9.001)
PHP Out-of-bounds Read Vulnerability (CVE-2019-11041)
WordPress Plugin BuddyPress Multiple Vulnerabilities (5.1.2)