CVE-2024-1316: event tickets — Exploit

Description

The Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the existence of certain events they shouldn't have access to. (e.g. draft, private, pending review, pw-protected, and trashed events).

Is your site exposed to CVE-2024-1316?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected Products

Vendor	Product	Versions
liquidweb	event_tickets	< 5.8.1
liquidweb	event_tickets	< 5.9.1

References

Exploits

https://wpscan.com/vulnerability/d80dfe2f-207d-4cdf-8c71-27936c6318e5/ https://wpscan.com/vulnerability/d80dfe2f-207d-4cdf-8c71-27936c6318e5/

Frequently Asked Questions

What is CVE-2024-1316? +

The Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the existence of certain events they shouldn't have access to. (e.g. draft, private, pending review, pw-protected, and trashed events). It has a CVSS v3.1 base score of 6.5 (MEDIUM).

How severe is CVE-2024-1316? +

CVE-2024-1316 has a CVSS v3.1 score of 6.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-1316? +

CVE-2024-1316 affects products from liquidweb, specifically: event_tickets. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-1316? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-11090 5.3

The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, …

CVE-2024-13457 5.3

The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, …

CVE-2024-1319 4.3

The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking …

CVE-2024-1053 4.3

The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability …

CVE-2024-1316