CVE-2024-1316 Event Tickets and Registration < 5.8.1 - Contributor+ Arbitrary Events Access

What is CVE-2024-1316?

CVE-2024-1316 is a medium-severity vulnerability in Unknown Event Tickets and Registration, published on 4 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the existence of certain events they shouldn't have access to. (e.g. draft, private, pending review, pw-protected, and trashed events).

Which versions are affected by CVE-2024-1316?

It affects 1 product.

Products include Liquidweb Event Tickets.

How do I fix CVE-2024-1316?

No fix has been published for CVE-2024-1316 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-1316 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-1316 exists.

Other vulnerabilities in Unknown Event Tickets and Registration

• CVE-2019-16120 Other in n/a High 8.8
• CVE-2024-13457 Event Tickets <= 5.18.1 - Insecure Direct Object Reference to Sensitive Information Exposure Medium 5.3
• CVE-2024-1319 Event Tickets Plus < 5.9.1 - Contributor+ Attendees Lists Disclosure Medium 4.3
• CVE-2024-1053 Event Tickets and Registration <= 5.8.1 - Missing Authorization Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wgfc-mmg5-p2xv.