Access Control Flaw in Events Calendar Plugin for WordPress
CVE-2024-5333

Currently unrated

Key Information:

Vendor
Wordpress
Status
The Events Calendar
Vendor
CVE Published:
16 December 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

CVE-2024-5333 is a significant security vulnerability affecting the Events Calendar plugin for WordPress, specifically in versions prior to 6.8.2.1. This flaw is characterized by a lack of proper access control checks within the REST API, which allows unauthenticated users to gain access to sensitive information related to password-protected events. As a result, attackers can exploit this vulnerability to disclose confidential event details, potentially exposing personal information and compromising user privacy. Website administrators using affected versions are strongly advised to update to the latest release to mitigate this risk.

Affected Version(s)

The Events Calendar 0 < 6.8.2.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-5333 - Proof of Concept

References

https://wpscan.com/vulnerability/764b5a23-8b51-4882-b899-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Felipe Caon
WPScan
.