CVE-2024-1319: event tickets — Exploit

Description

The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. (e.g. draft, private, pending review, password-protected, and trashed posts).

Is your site exposed to CVE-2024-1319?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected Products

Vendor	Product	Versions
liquidweb	event_tickets	< 5.9.1

References

Exploits

https://wpscan.com/vulnerability/5904dc7e-1058-4c40-bca3-66ba57b1414b/ https://wpscan.com/vulnerability/5904dc7e-1058-4c40-bca3-66ba57b1414b/

Frequently Asked Questions

What is CVE-2024-1319? +

The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. (e.g. draft, private, pending review, password-protected, and trashed posts). It has a CVSS v3.1 base score of 4.3 (MEDIUM).

How severe is CVE-2024-1319? +

CVE-2024-1319 has a CVSS v3.1 score of 4.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-1319? +

CVE-2024-1319 affects products from liquidweb, specifically: event_tickets. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-1319? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-1316 6.5

The Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users …

CVE-2024-13457 5.3

The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, …

CVE-2024-11090 5.3

The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, …

CVE-2024-1053 4.3

The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability …

CVE-2024-1319