5.3
Moyenne
CVE-2024-13457 The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all…
Description
The Event Tickets and Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.18.1 via the tc-order-id parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view order details of orders they did not place, which includes ticket prices, user emails and order date.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Event Tickets and Registration 5.18 | premières → 5.18.1 | Pas de correctif indiqué |
| Event Tickets and Registration 5.18 | premières → 5.18.1 | Pas de correctif indiqué |
Autres CVE de Event Tickets and Registration
Les 6 CVE de Event Tickets and Registration →
CVE-2025-11517
The Event Tickets and Registration plugin for WordPress is vulnerable to payment bypass in all versions up to, and…
7.5
Élevée
CVE-2025-1402
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing…
5.3
Moyenne
CVE-2022-4974
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request…
6.3
Moyenne
CVE-2024-2261
The Event Tickets and Registration plugin for WordPress is vulnerable to Sensitive Information Exposure in all…
4.3
Moyenne