PT-2024-17821 · WordPress · The Events Calendar

Scott Kingsley Clark · Published 2024-06-14 · Updated 2024-08-07 · CVE-2024-1295

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Events Calendar WordPress plugin versions prior to 6.4.0.1 The Events Calendar Pro WordPress plugin versions prior to 6.4.0.1

Description The issue allows users with at least the contributor role to leak details about events they should not have access to, including password-protected events and drafts.

Recommendations For The Events Calendar WordPress plugin versions prior to 6.4.0.1, update to version 6.4.0.1 or later. For The Events Calendar Pro WordPress plugin versions prior to 6.4.0.1, update to version 6.4.0.1 or later.

Exploit

Fix

Related Identifiers

CVE-2024-1295

Affected Products

The Events Calendar

References · 4

• 🔥 https://wpscan.com/vulnerability/3cffbeb0-545a-4002-b02c-0fa38cada1db · Exploit
• https://osv.dev/vulnerability/CVE-2024-1295 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1295 · Security Note
• https://twitter.com/CVEnew/status/1801547342119584002 · Twitter Post