VulnerabilityModified
CVE-2022-1054
As a result, unauthenticated attackers could call it and retrieve PII such as first name, last name and email address of user registered for events
MEDIUM 5.3EPSS 4.21%
Does this matter?
Lower severity and a low EPSS score (4.21%). Track it; it rarely justifies an emergency change on its own.
Description
The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and has the export function hooked to the init action. As a result, unauthenticated attackers could call it and retrieve PII such as first name, last name and email address of user registered for events
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 4.21% probability · 90th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-862
- Affected
- wpchill/rsvp and event management
- Source
- contact@wpscan.com
References
- https://wpscan.com/vulnerability/95a5fad1-e823-4571-8640-19bf5436578dExploit, Third Party Advisory
- https://wpscan.com/vulnerability/95a5fad1-e823-4571-8640-19bf5436578dExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.