CVE-2024-1319
Event Tickets Plus < 5.9.1 - Contributor+ Attendees Lists Disclosure
- State
- Published
- Severity
- 4.3 Medium
- Published
- Mar 4, 2024
- Updated
- Mar 27, 2025
- Reserved
- Feb 7, 2024
Description
The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. (e.g. draft, private, pending review, password-protected, and trashed posts).
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Events Tickets PlusUnknown |
|
References
- https://wpscan.com/vulnerability/5904dc7e-1058-4c40-bca3-66ba57b1414b/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.