Description
The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticated users to access information about password protected events.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected products
- Unknown / The Events Calendar0 – 6.8.2.1
Exploits & proofs of concept
- nucleiWordPress Events Calendar 6.8.2.1 - Information Disclosureby DhiyaneshDk
Updated 26m ago · 8 sources