CVE-2025-8091: EventON Lite <= 2.4.7 - Authenticated (Contributor+) Information Disclosure
The EventON Lite plugin for WordPress is vulnerable to Information Exposure in all versions less than, or equal to, 2.4.6 via the addsingleeventon and addeventon shortcodes due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8091?
CVE-2025-8091 is classified as a medium severity vulnerability due to information exposure risks.
How do I fix CVE-2025-8091?
To fix CVE-2025-8091, update the EventON Lite plugin to version 2.4.7 or later.
Who is affected by CVE-2025-8091?
All users of the EventON Lite plugin for WordPress versions 2.4.6 and earlier are affected by CVE-2025-8091.
What types of attacks can exploit CVE-2025-8091?
CVE-2025-8091 can be exploited by unauthenticated attackers to access restricted posts via vulnerable shortcodes.
Is CVE-2025-8091 easy to exploit?
Yes, CVE-2025-8091 can be exploited fairly easily due to insufficient restrictions on post access.