CVE-2024-1319: Event Tickets Plus < 5.9.1 - Contributor+ Attendees Lists Disclosure
Published Mar 4, 2024
·Updated
The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. (e.g. draft, private, pending review, password-protected, and trashed posts).
Affected Software
2 affected components
Modern Tribe Event Tickets Plus<5.9.1
Liquidweb Event Tickets Wordpress<5.9.1
Event History
Mar 4, 2024
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
DescriptionWeakness
Data Sourced
via NVD·09:15 PM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2024-1319?
CVE-2024-1319 has been classified as a medium severity vulnerability.
2
How do I fix CVE-2024-1319?
To fix CVE-2024-1319, update the Events Tickets Plus plugin to version 5.9.1 or later.
3
Who is affected by CVE-2024-1319?
Users with the contributor role in WordPress can leak the attendees list in any post type due to CVE-2024-1319.
4
Can CVE-2024-1319 be exploited on private posts?
Yes, CVE-2024-1319 allows users to access attendees lists even on private, draft, and trashed posts.
5
What does CVE-2024-1319 affect specifically?
CVE-2024-1319 affects the Events Tickets Plus WordPress plugin versions prior to 5.9.1.