Vulnerability · Published Jan 16, 2024 · Assigned by WPScan
CVE-2024-0235EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Email Address Disclosure
Medium 5.3
In plain English
A medium-severity security flaw in EventON from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 38.0% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)38.0%top 1.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling2Nuclei, Public PoC
Official description
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve email addresses of any users on the blog
Affected products (as reported)
References
- https://wpscan.com/vulnerability/e370b99a-f485-42bd-96a3-60432a15a4e9/ exploit, vdb-entry, technical-description