CVE-2022-1054 RSVP and Event Management < 2.7.8 - Unauthenticated Entries Export

2022-04-1817:10:47

CWE-862

WPScan

www.cve.org

0.003 Low

EPSS

Percentile

69.3%

JSON

The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and has the export function hooked to the init action. As a result, unauthenticated attackers could call it and retrieve PII such as first name, last name and email address of user registered for events

CNA Affected

[
  {
    "product": "RSVP and Event Management Plugin",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.7.2*",
        "status": "affected",
        "version": "2.7.2",
        "versionType": "custom"
      },
      {
        "lessThan": "2.7.8",
        "status": "affected",
        "version": "2.7.8",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/95a5fad1-e823-4571-8640-19bf5436578d

0.003 Low

EPSS

Percentile

69.3%

JSON

Related for CVELIST:CVE-2022-1054