CVE-2024-1319: Event Tickets Plus < 5.9.1 - Contributor+ Attendees Lists Disclosure

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-03-04 · updated 2026-06-17

Description

The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. (e.g. draft, private, pending review, password-protected, and trashed posts).

Affected products

stellarwp Event Tickets and Registration: before 5.9.1 — fixed in 5.9.1

How to fix

Upgrade to a fixed version: stellarwp Event Tickets and Registration 5.9.1. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/5904dc7e-1058-4c40-bca3-66ba57b1414b/
https://wpscan.com/vulnerability/5904dc7e-1058-4c40-bca3-66ba57b1414b/

Get alerted when CVE-2024-1319 or the next vulnerability affects your stack