Tickera – WordPress Event Ticketing, 188d7017-f5a1-478a-96eb-dac0ca4add57
- CVE, Research URL
- Application
- Published on
- -
- Research Description
- Tickera – Sell Tickets & Manage Events [tickera-event-ticketing-system] < 3.4.6.9 Tickera WordPress Event Ticketing < 3.4.6.9 - Unauthenticated Sensitive Data Exposure Due to missing authorization controls in the "admin_init" hooks, all personal data from registered users of an event could be exported into a downloadable PDF file by every unauthenticated user. The event ID could be read from the page source and/or easily enumerated in sequence. According to the original researcher, "After several attempts to contact the Plugin vendor (Twitter, email), we followed generally accepted disclosure guidelines. A lengthy correspondence with Tickera support was not successful as well." Edit (WPScanTeam) April 8th, 2020 - Report Received & Escalated to WP Plugins Team April 9th, 2002 - v3.4.6.9 released April 11th, 2020 - Disclosure
- Affected versions
-
max 3.4.6.9.
- Status
-
vulnerable