{"id":"CVE-2024-1319","state":"PUBLISHED","title":"Event Tickets Plus < 5.9.1 - Contributor+ Attendees Lists Disclosure","description":"The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. (e.g. draft, private, pending review, password-protected, and trashed posts).","publishedAt":"2024-03-04T21:00:09.049Z","updatedAt":"2025-03-27T16:48:48.662Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown Events Tickets Plus"],"affected":[{"vendor":"Unknown","product":"Events Tickets Plus","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.9.1","versionType":"semver"}]}],"references":["https://wpscan.com/vulnerability/5904dc7e-1058-4c40-bca3-66ba57b1414b/"],"weaknesses":[],"ingestedAt":"2026-10-29T20:06:59.846Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/1xxx/CVE-2024-1319.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-1319","state":"PUBLISHED","datePublished":"2024-03-04T21:00:09.049Z","dateUpdated":"2025-03-27T16:48:48.662Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2024-02-07T16:39:21.466Z"},"containers":{"cna":{"title":"Event Tickets Plus < 5.9.1 - Contributor+ Attendees Lists Disclosure","descriptions":[{"lang":"en","value":"The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. (e.g. draft, private, pending review, password-protected, and trashed posts)."}],"affected":[{"vendor":"Unknown","product":"Events Tickets Plus","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.9.1","versionType":"semver"}]}],"references":[{"url":"https://wpscan.com/vulnerability/5904dc7e-1058-4c40-bca3-66ba57b1414b/","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-284 Improper Access Control","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2024-03-04T21:00:09.049Z"},"credits":[{"lang":"en","value":"Scott Kingsley Clark","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-05-08T16:06:40.026748Z","id":"CVE-2024-1319","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-03-27T16:48:48.662Z"}},{"title":"CVE Program Container","references":[{"url":"https://wpscan.com/vulnerability/5904dc7e-1058-4c40-bca3-66ba57b1414b/","tags":["exploit","vdb-entry","technical-description","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T18:33:25.378Z"}}]}}}