CVE-2024-1319 Event Tickets Plus < 5.9.1 - Contributor+ Attendees Lists Disclosure

2024-03-0421:00:09

WPScan

www.cve.org

cve-2024-1319

event tickets plus

wordpress

plugin

attendees list

contributor role

security disclosure

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. (e.g. draft, private, pending review, password-protected, and trashed posts).

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Events Tickets Plus",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "5.9.1"
      }
    ],
    "defaultStatus": "unaffected"
  }
]