PT-2025-1653 · WordPress · Event Monster

Mike Harris + 1 · Published 2025-01-13 · Updated 2025-01-14 · CVE-2024-11396

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress versions up to, and including, 1.4.3

Description The issue concerns information exposure through the Visitors List Export file. During export, a CSV file is created in the wp-content folder with a hardcoded filename that is publicly accessible. This allows unauthenticated attackers to extract data about event visitors, including first and last names, email, and phone number.

Recommendations For versions up to, and including, 1.4.3, consider disabling the Visitors List Export feature until a patch is available to prevent unauthenticated access to sensitive visitor information. Restrict access to the wp-content folder to minimize the risk of exploitation. Avoid using the publicly accessible CSV file for sensitive data storage until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-359

Related Identifiers

CVE-2024-11396

Affected Products

Event Monster

References · 7

• https://osv.dev/vulnerability/CVE-2024-11396 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11396 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/0f522dfe-f2c2-4adb-980c-1f03d3c26e12?source=cve · Note
• https://twitter.com/CVEnew/status/1878949262417178966 · Twitter Post
• https://twitter.com/gothburz/status/1879151921807720465 · Twitter Post
• https://plugins.trac.wordpress.org/browser/event-monster/tags/1.4.3/em-ajax-prossesing/em-visitor-ajax.php#L92 · Note
• https://t.me/cvenotify/107259 · Telegram Post