PT-2022-13621 · WordPress · Rsvp/Event Management Plugin

Daniel Ruf · Published 2022-04-18 · Updated 2022-04-27 · CVE-2022-1054

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions RSVP and Event Management Plugin WordPress plugin versions prior to 2.7.8

Description The issue arises from the lack of authorization checks when exporting entries in the plugin, with the export function hooked to the init action. This allows unauthenticated attackers to call the function and retrieve personally identifiable information (PII) such as first name, last name, and email address of users registered for events.

Recommendations For versions prior to 2.7.8, update to version 2.7.8 or later to resolve the issue. As a temporary workaround, consider disabling the export function hooked to the init action until a patch is available. Restrict access to the export functionality to minimize the risk of exploitation. Avoid using the export function in the affected plugin until the issue is resolved.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-1054

Affected Products

Rsvp/Event Management Plugin

References · 5

• 🔥 https://wpscan.com/vulnerability/95a5fad1-e823-4571-8640-19bf5436578d · Exploit
• https://osv.dev/vulnerability/CVE-2022-1054 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1054 · Security Note
• https://t.me/cibsecurity/41072 · Telegram Post
• https://t.me/cvenotify/29365 · Telegram Post