CVE-2024-2261

MEDIUM

Event Tickets and Registration <= 5.8.2 - Authenticated Sensitive Information Exposure via RSVP Functionality

Title source: llm

Description

The Event Tickets and Registration plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.8.2 via the RSVP functionality. This makes it possible for authenticated attackers, with contributor access and above, to extract sensitive data including emails and street addresses.

References (2)

Core 2

Core References

Product

https://plugins.trac.wordpress.org/changeset?old_path=/event-tickets/tags/5.8.2&old=3059268&new_path=/event-tickets/tags/5.8.3&new=3059268&sfp_email=&sfph_mail=

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/2e42dd1c-adf7-471a-a14a-9038c56413a2?source=cve

Scores

CVSS v3 4.3

EPSS 0.0040

EPSS Percentile 31.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-639

Status published

Products (2)

stellarwp/Event Tickets and Registration < 5.8.2

theeventscalendar/Event Tickets and Registration < 5.8.2

Published Apr 09, 2024

Tracked Since Feb 18, 2026