PT-2025-2071 · WordPress · Ht Event – Wordpress Event Manager Plugin For Elementor
Ankit Patel
·
Published
2025-01-31
·
Updated
2025-01-31
·
CVE-2024-13216
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
The HT Event – WordPress Event Manager Plugin for Elementor plugin for WordPress versions up to, and including, 1.4.7
Description
The issue allows authenticated attackers with Contributor-level access and above to extract sensitive private, pending, scheduled, and draft template data via the
render function in /includes/widgets/htevent sponsor.php. This makes it possible for attackers to access sensitive information.Recommendations
For versions up to, and including, 1.4.7, consider disabling the
render function in /includes/widgets/htevent sponsor.php until a patch is available to prevent exploitation. Restrict access to the /includes/widgets/htevent sponsor.php file to minimize the risk of sensitive information exposure. Avoid using the render function for sensitive template data until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability. Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ht Event – Wordpress Event Manager Plugin For Elementor