CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Events Calendar plugin for WordPress is vulnerable to information disclosure in versions up to, and including, 6.15.9. The sysinfo REST endpoint compares the provided key to the stored opt-in key using a loose comparison, allowing unauthenticated attackers to send a boolean value and obtain the full system report whenever "Yes, automatically share my system information with The Events Calendar support team" setting is enabled.
Explanation of Vulnerability in Simple Terms
The Events Calendar versions 6.15.9 and earlier contain an information disclosure vulnerability. An attacker on the network can read sensitive data without authentication or user interaction. The vulnerability affects how the plugin handles data access controls, potentially exposing event information or other site data to unauthorized parties.
What an attacker can do
Read sensitive event data or other information without logging in.
Potential impact on your site
Unauthorized visitors may access private event details or other confidential information stored by the plugin.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
