CVE-2026-122087lowCWE-200

CVE-2026-122087: falha de baixa gravidade em Event Tickets and Registration

Event Tickets < 5.30.3.1 - Unauthenticated Private Event Attendee Disclosure via post_status Filter Bypass in Attendees REST API

Publicada em

Seguir esta CVE+ Monitorar Event Tickets and Registration

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 3.7epss 0.2%
The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not restrict attendee data to events the requester is allowed to view, allowing unauthenticated users to retrieve the attendees of private and other non-public events.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
Unknown · Event Tickets and Registration
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Event Tickets and Registration

No mesmo produto, das mais perigosas para as menos.

CVE-2024-1316MEDIUMEvent Tickets and Registration < 5.8.1 - Contributor+ Arbitrary Events AccessEPSS 0.6%CVE-2026-14822MEDIUMEvent Tickets < 5.29.0.1 - Unauthenticated PayPal Order Status ManipulationEPSS 0.3%CVE-2026-122061MEDIUMEvent Tickets < 5.30.3.1 - Unauthenticated Attendee Name Disclosure via Single Attendee REST EndpointEPSS 0.3%CVE-2026-14819LOWEvent Tickets < 5.28.4 - Editor+ Stored XSS via Ticket MoveEPSS 0.2%CVE-2026-14823LOWEvent Tickets < 5.29.0.1 - Contributor+ Seating Layout and Ticket Inventory Modification via IDOREPSS 0.2%