CVE-2024-1319

2024-03-0421:15:07

[email protected]

web.nvd.nist.gov

cve-2024

wordpress

plugin

security

exploit

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. (e.g. draft, private, pending review, password-protected, and trashed posts).

Affected configurations

Vulners

Node

tickets_projectticketsRange<5.9.1

VendorProductVersionCPE
tickets_projecttickets*cpe:2.3:a:tickets_project:tickets:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
tickets_project	tickets	*	cpe:2.3:a:tickets_project:tickets::::::::

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Events Tickets Plus",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "5.9.1"
      }
    ],
    "defaultStatus": "unaffected"
  }
]