5.3

CVE-2023-6557

The Events Calendar <= 6.2.8.2 - Unauthenticated Sensitive Information Exposure

The Events Calendar <= 6.2.8.2 - Unauthenticated Sensitive Information Exposure

The The Events Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.2.8.2 via the route function hooked into wp_ajax_nopriv_tribe_dropdown. This makes it possible for unauthenticated attackers to extract potentially sensitive data including post titles and IDs of pending, private and draft posts.
Mögliche Gegenmaßnahme
The Events Calendar: Update to version 6.2.9, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Stellarwp ≫ The Events Calendar SwPlatformwordpress Version <= 6.2.8.2
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt The Events Calendar
Version *-6.2.8.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.56% 0.422
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
security@wordfence.com 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3010104%40the-events-calendar%2Ftags%2F6.2.9&old=3010096%40the-events-calendar%2Ftags%2F6.2.9
Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/fc40196e-c0f3-4bc6-ac4b-b866902def61?source=cve
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/fc40196e-c0f3-4bc6-ac4b-b866902def61
Third Party Advisory