The EventON Lite plugin contains an information exposure flaw in the add_single_eventon and add_eventon shortcodes. Because the plugin does not properly enforce content visibility, an attacker can trigger these shortcodes and cause the plugin to retrieve and expose data from password protected, private, or draft posts that should otherwise be inaccessible. The vulnerability is categorized as Vulnerability #200, highlighting that data that should remain confidential can be elected by an attacker. The effect is not a remote code execution or privilege escalation but a direct leak of protected content, compromising the confidentiality of the site’s internal or restricted information.

WordPress sites that have installed the ashanjay EventON – Events Calendar plugin, versions less than or equal to 2.4.6 (the CVE notes that any release up to 2.4.6 is vulnerable, while the title references 2.4.7 but the description specifies 2.4.6). Sites that use the add_single_eventon or add_eventon shortcodes within posts or pages are directly affected, regardless of whether those pages are publicly visible.

The CVSS base score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% suggests that public exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog, further indicating low public interest. Attackers can exploit the flaw by inserting or triggering the vulnerable shortcodes through any accessible page, which can be achieved by an unauthenticated user if the shortcode is embedded in a public post. The security risk arises from the leakage of sensitive content rather than from privilege escalation or destructive payload delivery.