CVE-2024-13457: Event Tickets <= 5.18.1 - Insecure Direct Object Reference to Sensitive Information Exposure
The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.18.1 via the tc-order-id parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view order details of orders they did not place, which includes ticket prices, user emails and order date.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13457?
CVE-2024-13457 is rated as a medium severity vulnerability due to the potential for unauthorized access to sensitive information.
How do I fix CVE-2024-13457?
To fix CVE-2024-13457, update the Event Tickets and Registration plugin to the latest version available after 5.18.1.
What does CVE-2024-13457 exploit?
CVE-2024-13457 exploits an Insecure Direct Object Reference in the tc-order-id parameter due to inadequate validation.
Who is affected by CVE-2024-13457?
Any user utilizing the Event Tickets and Registration plugin for WordPress versions up to and including 5.18.1 is affected by CVE-2024-13457.
Can CVE-2024-13457 be exploited remotely?
Yes, CVE-2024-13457 can be exploited remotely by an unauthenticated attacker.