CVE-2026-122087lowCWE-200

CVE-2026-122087: fallo de gravedad baja en Event Tickets and Registration

Event Tickets < 5.30.3.1 - Unauthenticated Private Event Attendee Disclosure via post_status Filter Bypass in Attendees REST API

Publicada el

Seguir esta CVE+ Monitorear Event Tickets and Registration

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 3.7epss 0.2%
The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not restrict attendee data to events the requester is allowed to view, allowing unauthenticated users to retrieve the attendees of private and other non-public events.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
Unknown · Event Tickets and Registration
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Event Tickets and Registration

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-1316MEDIUMEvent Tickets and Registration < 5.8.1 - Contributor+ Arbitrary Events AccessEPSS 0.6%CVE-2026-14822MEDIUMEvent Tickets < 5.29.0.1 - Unauthenticated PayPal Order Status ManipulationEPSS 0.3%CVE-2026-122061MEDIUMEvent Tickets < 5.30.3.1 - Unauthenticated Attendee Name Disclosure via Single Attendee REST EndpointEPSS 0.3%CVE-2026-14819LOWEvent Tickets < 5.28.4 - Editor+ Stored XSS via Ticket MoveEPSS 0.2%CVE-2026-14823LOWEvent Tickets < 5.29.0.1 - Contributor+ Seating Layout and Ticket Inventory Modification via IDOREPSS 0.2%