Vulnerability Description
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve the settings of arbitrary virtual events, including any meeting password set (for example for Zoom)
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Myeventon | Eventon | < 2.2.7 |
Related Weaknesses (CWE)
References
- https://wpscan.com/vulnerability/09aeb6f2-6473-4de7-8598-e417049896d7/Third Party Advisory
- https://wpscan.com/vulnerability/09aeb6f2-6473-4de7-8598-e417049896d7/Third Party Advisory
FAQ
What is CVE-2024-0236?
CVE-2024-0236 is a vulnerability with a CVSS score of 5.3 (MEDIUM). The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve the settings of arbitrary virtu...
How severe is CVE-2024-0236?
CVE-2024-0236 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-0236?
Check the references section above for vendor advisories and patch information. Affected products include: Myeventon Eventon.