CVE-2024-11396

MEDIUM NUCLEI

Event Monster - Info Disclosure

Title source: llm

Description

The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Export file. During the export, a CSV file is created in the wp-content folder with a hardcoded filename that is publicly accessible. This makes it possible for unauthenticated attackers to extract data about event visitors, that includes first and last names, email, and phone number.

Exploits (2)

github WORKING POC 40 stars
by iSee857 · pythonpoc
https://github.com/iSee857/CVE-PoC/tree/main/WordPress_CVE-2024-11396_DataBreach.py
nomisec WORKING POC
by RandomRobbieBF · poc
https://github.com/RandomRobbieBF/CVE-2024-11396

Nuclei Templates (1)

Event Monster <= 1.4.3 - Information Exposure Via Visitors List Export
MEDIUMVERIFIEDby s4e-io
Shodan: http.html:"wp-content/plugins/event-monster"
FOFA: body="wp-content/plugins/event-monster"

References (2)

Scores

CVSS v3 5.3
EPSS 0.5835
EPSS Percentile 98.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Classification

CWE
CWE-359
Status published

Affected Products (1)

awplife/event_monster < 1.4.4

Timeline

Published Jan 14, 2025
Tracked Since Feb 18, 2026