What is CVE-2024-1295?

CVE-2024-1295 is a medium-severity vulnerability in Tri The_events_calendar, classified under CWE-639 AUTHORIZATION BYPASS THROUGH USER-CONTROLLED KEY. CVSS score: 6.5/10. Published 2024-06-14.

How severe is CVE-2024-1295?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Tri The_events_calendar

CVE-2024-1295

The events-calendar-pro WordPress plugin before 6.4.0.1, The Events Calendar WordPress plugin before 6.4.0.1 does not prevent users with at least the contributor role from leaking details about events they shouldn't have access to. (e.g. p…

EPSS: 0.005 (36.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Tri The_events_calendar
Unknown Events-calendar-pro — versions 0
Unknown The Events Calendar — versions 0

References

contact@wpscan.com (Exploit, technical-description, Third Party Advisory, exploit, vdb-entry)

Frequently asked questions

What is CVE-2024-1295?: CVE-2024-1295 is a medium-severity vulnerability in Tri The_events_calendar, classified under CWE-639 AUTHORIZATION BYPASS THROUGH USER-CONTROLLED KEY. CVSS score: 6.5/10. Published 2024-06-14.
How severe is CVE-2024-1295?: Medium severity. CVSS v3 base score is 6.5 out of 10.