Plugin Vulnerability Allows Unauthorized Access to Private Events
CVE-2024-1316
Currently unrated
What is CVE-2024-1316?
The Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the existence of certain events they shouldn't have access to. (e.g. draft, private, pending review, pw-protected, and trashed events).
Affected Version(s)
Event Tickets and Registration 0 < 5.8.1
Events Tickets Plus 0 < 5.9.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.