RSVP and Event Management <= 2.7.7 - Unauthenticated Sensitive Information Disclosure
2022-04-11 00:00
Daniel RufStrategic Overview
StatusPatched in 2.7.8
Affected PluginRSVP and Event Management
Affected Version
<= 2.7.7CVSS5.3Medium
CVE
CVE-2022-1054Vulnerability Overview
The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and has the export function hooked to the init action. As a result, unauthenticated attackers could call it and retrieve PII such as first name, last name and email address of user registered for events
Technical Analysis
REMEDIATION: Update to version 2.7.8, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C