TI-2024-01225 Aliases CVE-2024-1316 GHSA-wgfc-mmg5-p2xv

Event Tickets and Registration < 5.8.1 - Contributor+ Arbitrary Events Access

MEDIUM 62Published 2024-03-04 · Updated 2024-08-28

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

The Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the existence of certain events they shouldn't have access to. (e.g. draft, private, pending review, pw-protected, and trashed events).

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00604 49th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA and NVD

Fix Fixed Event Tickets and Registration (Unknown): 5.8.1Events Tickets Plus (Unknown): 5.9.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Event Tickets and Registration	before 5.8.1	5.8.1	Patch available	CNA
Unknown	Events Tickets Plus	before 5.9.1	5.9.1	Patch available	CNA

Event Tickets and Registration VendorUnknown Affected before 5.8.1 Fixed in 5.8.1 Patch available CNA
Events Tickets Plus VendorUnknown Affected before 5.9.1 Fixed in 5.9.1 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:liquidweb:event_tickets:::::free:wordpress::	before 5.8.1	Vulnerable	Liquid Web
cpe:2.3:a:liquidweb:event_tickets:::::plus:wordpress::	before 5.9.1	Vulnerable	Liquid Web

cpe:2.3:a:liquidweb:event_tickets:*:*:*:*:free:wordpress:*:* Versions before 5.8.1 Vulnerable ·Liquid Web
cpe:2.3:a:liquidweb:event_tickets:*:*:*:*:plus:wordpress:*:* Versions before 5.9.1 Vulnerable ·Liquid Web

Remediation

Fix · CNA Event Tickets and Registration (Unknown) Fixed in 5.8.1
Fix · CNA Events Tickets Plus (Unknown) Fixed in 5.9.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2024-03-04
Events Tickets Plus 5.9.1
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2024-01228 Event Tickets Plus < 5.9.1 - Contributor+ Attendees Lists DisclosurePriority MEDIUM 53
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2024-1316
2026-10-03 Alias added: GHSA-wgfc-mmg5-p2xv

References

Exploit 1

https://wpscan.com/vulnerability/d80dfe2f-207d-4cdf-8c71-27936c6318e5/

TI-2024-01228 Event Tickets Plus < 5.9.1 - Contributor+ Attendees Lists Disclosure CVSS 3.1MEDIUM 4.3
TI-2019-12112 CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress… CVSS 3.1HIGH 8.8
TI-2024-12498 Event Tickets <= 5.18.1 - Insecure Direct Object Reference to Sensitive Information Exposure CVSS 3.1MEDIUM 5.3
TI-2024-00974 Event Tickets and Registration <= 5.8.1 - Missing Authorization CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences