1. Home
  2. CVE Database
  3. CVE-2024-1319
MEDIUM · 4.3

CVE-2024-1319

The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. (e.g. draft, priv...

Vulnerability Description

The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. (e.g. draft, private, pending review, password-protected, and trashed posts).

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
LiquidwebEvent Tickets< 5.9.1

References

FAQ

What is CVE-2024-1319?

CVE-2024-1319 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. (e.g. draft, priv...

How severe is CVE-2024-1319?

CVE-2024-1319 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-1319?

Check the references section above for vendor advisories and patch information. Affected products include: Liquidweb Event Tickets.