1. Home
  2. CVE Database
  3. CVE-2024-1053
MEDIUM · 4.3

CVE-2024-1053

The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'email' action in all versions up to, and including, 5.8.1...

Vulnerability Description

The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'email' action in all versions up to, and including, 5.8.1. This makes it possible for authenticated attackers, with contributor-level access and above, to email the attendees list to themselves.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
LiquidwebEvent Tickets< 5.8.2

Related Weaknesses (CWE)

CWE-284CWE-862

References

FAQ

What is CVE-2024-1053?

CVE-2024-1053 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'email' action in all versions up to, and including, 5.8.1...

How severe is CVE-2024-1053?

CVE-2024-1053 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-1053?

Check the references section above for vendor advisories and patch information. Affected products include: Liquidweb Event Tickets.