What the vulnerability does
01Description
The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Export file. During the export, a CSV file is created in the wp-content folder with a hardcoded filename that is publicly accessible. This makes it possible for unauthenticated attackers to extract data about event visitors, that includes first and last names, email, and phone number.
Explanation of Vulnerability in Simple Terms
02Summary
Event Monster – Manager & Ticket Booking versions 1.4.3 and earlier contain a privacy disclosure vulnerability. An attacker can read sensitive information about events and bookings without authentication. The plugin does not properly restrict access to certain data endpoints, allowing unauthorized information disclosure.
What an attacker can do
03Attacker Capabilities
Read sensitive event and booking information without logging in.
Potential impact on your site
04Site Impact
Visitor data, event details, and booking information may be exposed to anyone on the internet.
Conditions required to exploit
05Prerequisites
Network access to the WordPress site; no authentication or user interaction required.
Key dates
06Disclosure timeline
January 13, 2025
CVE published
April 8, 2026
Record updated
