Plugin Vulnerability Allows Unauthorized Access to Private Events
CVE-2024-1316

Currently unrated

Key Information:

Vendor
Wordpress
Status
Event Tickets And Registration
Events Tickets Plus
Vendor
CVE Published:
4 March 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

The Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the existence of certain events they shouldn't have access to. (e.g. draft, private, pending review, pw-protected, and trashed events).

Affected Version(s)

Event Tickets and Registration 0 < 5.8.1

Events Tickets Plus 0 < 5.9.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-1316 - Proof of Concept

References

https://wpscan.com/vulnerability/d80dfe2f-207d-4cdf-8c71-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Scott Kingsley Clark
WPScan
.