CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 7.2.2.2 via the 'get_location' action due to insufficient restrictions on which locations can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft event locations that they should not have access to.
Explanation of Vulnerability in Simple Terms
Events Manager for WordPress contains an information exposure vulnerability in versions up to 7.2.2.2. The plugin exposes sensitive data that can be accessed over the network without authentication or user interaction. An attacker can read this information remotely, though the exposure is limited in scope. Update to a version newer than 7.2.2.2 to resolve this issue.
What an attacker can do
Read sensitive information exposed by the plugin without needing to log in.
Potential impact on your site
Sensitive data may be visible to unauthenticated visitors; review what information is exposed.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
