4.3

CVE-2024-1319

Exploit

Event Tickets Plus < 5.9.1 - Contributor+ Attendees Lists Disclosure

Events Tickets Plus <= 5.9.0 - Missing Authorization to Information Exposure

The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. (e.g. draft, private, pending review, password-protected, and trashed posts).
Mögliche Gegenmaßnahme
Events Tickets Plus: Update to version 5.9.1, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Liquidweb ≫ Event Tickets SwEdition plus SwPlatform wordpress Version < 5.9.1
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Events Tickets Plus
Version *-5.9.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.46% 0.361
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://wpscan.com/vulnerability/5904dc7e-1058-4c40-bca3-66ba57b1414b/
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/28e16994-a03f-4b3a-9f45-e6b0a1334c98
Third Party Advisory