CVE-2024-0236: EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Virtual Event Password Disclosure
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve the settings of arbitrary virtual events, including any meeting password set (for example for Zoom)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0236?
CVE-2024-0236 has been classified as a high-severity vulnerability due to the exposure of sensitive settings to unauthenticated users.
How do I fix CVE-2024-0236?
To fix CVE-2024-0236, update the EventON WordPress plugin to version 4.5.5 or later, or 2.2.7 or later.
What types of information are exposed by CVE-2024-0236?
CVE-2024-0236 allows unauthorized access to the settings of virtual events, including confidential meeting passwords.
Which versions of the EventON plugin are affected by CVE-2024-0236?
CVE-2024-0236 affects EventON plugin versions prior to 4.5.5 and 2.2.7.
Are there any user permissions required to exploit CVE-2024-0236?
No user permissions are required to exploit CVE-2024-0236 as it can be triggered by unauthenticated users.