CVE-2024-1316: Event Tickets and Registration < 5.8.1 - Contributor+ Arbitrary Events Access

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-03-04 · updated 2026-06-17

Description

The Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the existence of certain events they shouldn't have access to. (e.g. draft, private, pending review, pw-protected, and trashed events).

Affected products

stellarwp Event Tickets and Registration: before 5.8.1; before 5.9.1 — fixed in 5.8.1, 5.9.1

How to fix

Upgrade to a fixed version: stellarwp Event Tickets and Registration 5.8.1, 5.9.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-1316 or the next vulnerability affects your stack