CVE-2024-12578: Tickera – WordPress Event Ticketing <= 3.5.4.8 - Unauthenticated Customer Data Exposure
The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.5.4.8 via the 'tickeraticketsinfo' endpoint. This makes it possible for unauthenticated attackers to extract sensitive data from bookings like full names, email addresses, check-in/out timestamps and more.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12578?
CVE-2024-12578 is considered a critical vulnerability due to the potential for unauthenticated information exposure.
How do I fix CVE-2024-12578?
To fix CVE-2024-12578, update the Tickera – WordPress Event Ticketing plugin to version 3.5.4.9 or later.
What data is exposed in CVE-2024-12578?
CVE-2024-12578 allows attackers to extract sensitive booking information from the 'tickera_tickets_info' endpoint.
Which versions are affected by CVE-2024-12578?
CVE-2024-12578 affects all versions of the Tickera plugin up to and including version 3.5.4.8.
Who can exploit CVE-2024-12578?
CVE-2024-12578 can be exploited by unauthenticated attackers, making it highly accessible.