Event Easy Calendar 1.0.0 WP plugin

[roguecoder@xxxxxxxx]

Details
========================
Application: Event Easy Calendar
Version: 1.0.0
Type: WordPress Plugin
Vendor: Adamson ( http://profiles.wordpress.org/adamson/ )
Url: http://wordpress.org/plugins/event-easy-calendar/
Vulnerability:
- Improper Input Validation (CWE-20)
- Cross-Site Scripting (CWE-79)
- Cross-Site Request Forgery (CWE-352)

Description
========================
Events Easy Calendar will enable WordPress sites to manage all their bookings 
and appointments.

Vulnerability
========================
This plugin contains CSRF on all forms and some are also vulnerable to XSS. 
This entire plugin can be remotely controlled by crafting arbitrary payloads 
and send a malicious link to a site admin. By doing this you can create and 
update customers, create new services/cupons, change settings, enable 
reminders/auto approval, delete all bookings, etc. It's also possible to modify 
the PayPal recipient email address, so that all payments are sent to the 
attacker instead of the service provider. The cost of any services are also 
easily modified.

Solution
========================
No fix by vendor at this point. Remove the plugin from your WordPress 
installation.

Timeline
========================
2013-08-15 Wrote a comment pointing out to the vendor that there was some 
vulnerabilities and that a report would be made the same day. Comment was 
deleted.
2013-08-15 Contacted the vendor through the plugin support section on 
wordpress.org, where I requested a valid email to send the report to.
2013-08-16 Third and last message sent to vendor in an attempt to get a valid 
email address to send the report to
2013-08-16 An email address were provided by the plugin developer
2013-08-25 Vulnerability details were sent to the provided email address
2013-09-02 Details were sent to plugins@xxxxxxxxxxxxx
2013-09-05 Confirmation email recieved from Wordpress
2013-09-05 Plugin has been removed from the plugin directory
2013-09-07 Publicly disclosed