Vulnerability · Published Dec 16, 2024 · Assigned by WPScan
CVE-2024-5333The Events Calendar < 6.8.2.1 - Unauthenticated Password Protected Event Disclosure
Medium 5.3
In plain English
A medium-severity security flaw in The Events Calendar from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)1.1%top 33.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Nuclei
Official description
The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticated users to access information about password protected events.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | The Events Calendar | 0 – before 6.8.2.1 |
References
- https://wpscan.com/vulnerability/764b5a23-8b51-4882-b899-beb54f684984/ exploit, vdb-entry, technical-description