CVE-2024-0235

medium · 5.3

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve email addresses of any users on the blog

5.3

CVSS

38.0%

EPSS (exploit prob.)

98th

EPSS percentile

2024-01-16

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-862

Affected products

Vendor	Product	Affected versions
myeventon	eventon	< 2.2.7
myeventon	eventon	>= 4.0, < 4.5.5

Check a specific version with /api/v1/cve/match.

References

https://wpscan.com/vulnerability/e370b99a-f485-42bd-96a3-60432a15a4e9/
https://wpscan.com/vulnerability/e370b99a-f485-42bd-96a3-60432a15a4e9/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-0235