CVE-2024-5333: The Events Calendar < 6.8.2.1 - Unauthenticated Password Protected Event Disclosure
Published Dec 16, 2024
·Updated
The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticated users to access information about password protected events.
Affected Software
2 affected components
The Events Calendar The Events Calendar<6.8.2.1
Stellarwp The Events Calendar Wordpress<6.8.2.1
Event History
Dec 16, 2024
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2024-5333?
The severity of CVE-2024-5333 is categorized as high due to unauthorized access to protected event information.
2
How do I fix CVE-2024-5333?
To fix CVE-2024-5333, update the Events Calendar plugin to version 6.8.2.1 or later.
3
Which versions of The Events Calendar are affected by CVE-2024-5333?
CVE-2024-5333 affects all versions of The Events Calendar before 6.8.2.1.
4
What type of attack can exploit CVE-2024-5333?
CVE-2024-5333 can be exploited by unauthorized users accessing sensitive information through the REST API.
5
Is authentication required to exploit CVE-2024-5333?
No, authentication is not required to exploit CVE-2024-5333, making it especially dangerous.