CVE-2024-1319

Event Tickets Plus < 5.9.1 - Contributor+ Attendees Lists Disclosure

The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. (e.g. draft, private, pending review, password-protected, and trashed posts).

Affected

Events Tickets Plus

CVSS v3.1 CNA

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.46% chance of exploitation in the next 30 days, 38th percentile

Published

2024-03-04

Updated

2025-03-27

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/5904dc7e-1058-4c40-bca3-66ba57b1414b/

Security advisories

• https://wpscan.com/vulnerability/5904dc7e-1058-4c40-bca3-66ba57b1414b

References

• CVE Record
• NVD entry