Description
The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. (e.g. draft, private, pending review, password-protected, and trashed posts).
Published: 2024-03-04
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-17077 The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. (e.g. draft, private, pending review, password-protected, and trashed posts).
History

Thu, 24 Apr 2025 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Liquidweb
Liquidweb event Tickets
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:a:liquidweb:event_tickets:*:*:*:*:plus:wordpress:*:*
Vendors & Products Liquidweb
Liquidweb event Tickets

Thu, 27 Mar 2025 17:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Liquidweb Event Tickets
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2025-03-27T16:48:48.662Z

Reserved: 2024-02-07T16:39:21.466Z

Link: CVE-2024-1319

cve-icon Vulnrichment

Updated: 2024-08-01T18:33:25.378Z

cve-icon NVD

Status : Analyzed

Published: 2024-03-04T21:15:07.083

Modified: 2025-04-24T15:15:11.847

Link: CVE-2024-1319

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses