CVE-2024-0235: EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Email Address Disclosure
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve email addresses of any users on the blog
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0235?
CVE-2024-0235 is classified as a high severity vulnerability due to the potential exposure of user email addresses.
How do I fix CVE-2024-0235?
To fix CVE-2024-0235, update the EventON WordPress plugin to version 4.5.5 or higher for the affected versions.
Who is affected by CVE-2024-0235?
CVE-2024-0235 affects users of the EventON WordPress plugin versions prior to 4.5.5 and 2.2.7.
What does CVE-2024-0235 exploit?
CVE-2024-0235 exploits a lack of authorization in an AJAX action, allowing unauthorized access to user email addresses.
Can CVE-2024-0235 lead to data breach?
Yes, CVE-2024-0235 can lead to a data breach by disclosing email addresses of any blog users to unauthenticated users.