CVE-2024-1319 Event Tickets Plus < 5.9.1 - Contributor+ Attendees Lists Disclosure
Contributors can leak attendee lists from any post type, including private or draft posts, exposing sensitive user data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-1319?
CVE-2024-1319 is a medium-severity vulnerability in Unknown Events Tickets Plus, published on 4 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. (e.g. draft, private, pending review, password-protected, and trashed posts).
Which versions are affected by CVE-2024-1319?
It affects 1 product.
Products include Liquidweb Event Tickets.
How do I fix CVE-2024-1319?
No fix has been published for CVE-2024-1319 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-1319 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-1319 exists.
Other vulnerabilities in Unknown Events Tickets Plus
- CVE-2019-16120 Other in n/a
- CVE-2024-1316 Event Tickets and Registration < 5.8.1 - Contributor+ Arbitrary Events Access
- CVE-2024-13457 Event Tickets <= 5.18.1 - Insecure Direct Object Reference to Sensitive Information Exposure
- CVE-2024-1053 Event Tickets and Registration <= 5.8.1 - Missing Authorization
Sources
Also known as GHSA-j63f-r65c-3x8x.