CVE-2024-0235

EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Email Address Disclosure

The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve email addresses of any users on the blog

Affected

EventON

CVSS v3.1 NVD

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

37.96% chance of exploitation in the next 30 days, 99th percentile

Nuclei

medium · CWE-862

Published

2024-01-16

Updated

2025-06-20

Proof-of-concept exploits (3)

• https://wpscan.com/vulnerability/e370b99a-f485-42bd-96a3-60432a15a4e9/
• Cappricio-Securities/CVE-2024-02350★ · 2024-06-24
• Nxploited/CVE-2024-0235-PoC0★ · 2025-01-30

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0235.yaml

Security advisories

• https://wpscan.com/vulnerability/e370b99a-f485-42bd-96a3-60432a15a4e9

References

• CVE Record
• NVD entry

Related

• CVE-2000-0114
• CVE-2009-0347
• CVE-2012-5321
• CVE-2015-1635
• CVE-2015-7297
• CVE-2017-7269