CVE-2024-1053: Event Tickets and Registration <= 5.8.1 - Missing Authorization
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'email' action in all versions up to, and including, 5.8.1. This makes it possible for authenticated attackers, with contributor-level access and above, to email the attendees list to themselves.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/Event Tickets and Registrationto a version that resolves this vulnerability.Fixed in 5.8.1 - Configuration
Update the Event Tickets and Registration plugin to address the missing capability check on the 'email' action (affects all versions up to and including 5.8.1).
WordPress (Event Tickets and Registration plugin) capability check for 'email' action = Add missing capability check so only authorized users can execute the 'email' action
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1053?
CVE-2024-1053 is considered a high severity vulnerability due to the potential unauthorized access it allows.
How do I fix CVE-2024-1053?
To fix CVE-2024-1053, update the Event Tickets and Registration plugin to version 5.8.2 or later.
Who is affected by CVE-2024-1053?
CVE-2024-1053 affects all versions of the Event Tickets and Registration plugin for WordPress up to and including 5.8.1.
What type of access is exploited in CVE-2024-1053?
CVE-2024-1053 allows authenticated attackers with contributor-level access and above to exploit the vulnerability.
What kind of data can be accessed due to CVE-2024-1053?
CVE-2024-1053 enables unauthorized access to sensitive data related to ticket and registration information.