EventON Lite <= 2.4.7 - Authenticated (Contributor+) Information Disclosure
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.4%
probabilidade de exploração
0.4%top 67% das CVEs
exploração observada
nãonenhuma fonte reporta
The EventON Lite plugin for WordPress is vulnerable to Information Exposure in all versions less than, or equal to, 2.4.6 via the add_single_eventon and add_eventon shortcodes due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
ashanjay · EventON – Events CalendarReferências
https://plugins.trac.wordpress.org/browser/eventon-lite/trunk/includes/calendar/class-calendar_generator.php#L954https://plugins.trac.wordpress.org/browser/eventon-lite/trunk/includes/class-event.php#L39https://plugins.trac.wordpress.org/browser/eventon-lite/trunk/includes/class-evo-shortcodes.php#L32https://plugins.trac.wordpress.org/browser/eventon-lite/trunk/includes/class-evo-shortcodes.php#L81https://plugins.trac.wordpress.org/changeset/3345262https://wordpress.org/plugins/eventon-lite/https://www.wordfence.com/threat-intel/vulnerabilities/id/421fcee2-a05d-4486-837e-ddee3d73d737?source=cve