CVE-2024-11396 Event monster <= 1.4.3 - Information Exposure Via Visitors List Export
Unauthenticated attackers can access exported visitor data via a publicly accessible CSV file with a hardcoded filename.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-11396?
CVE-2024-11396 is a medium-severity vulnerability in awordpresslife Event Monster – Manager & Ticket Booking, published on 13 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Export file. During the export, a CSV file is created in the wp-content folder with a hardcoded filename that is publicly accessible. This makes it possible for unauthenticated attackers to extract data about event visitors, that includes first and last names, email, and phone number.
Weakness: CWE-359
Which versions are affected by CVE-2024-11396?
It affects 1 product.
Products include Awplife Event Monster.
How do I fix CVE-2024-11396?
No fix has been published for CVE-2024-11396 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-11396 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-11396 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in awordpresslife Event Monster – Manager & Ticket Booking
- CVE-2024-1895 Event Monster <= 1.3.9 - Authenticated(Contributor+) PHP Object Injection via Custom Meta
- CVE-2022-3720 Event Monster < 1.2.1 - Admin+ SQLi
- CVE-2023-47525 WordPress Event Management Tickets Booking Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-5059 WordPress Event Monster Plugin <= 1.4.0 - Sensitive Data Exposure vulnerability
- CVE-2022-3336 Event Monster < 1.2.0 - Visitors Deletion via CSRF
Sources
Also known as GHSA-6x4w-fvqp-6jvc.