CVE-2023-6557

The The Events Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.2.8.2 via the route function hooked into wp_ajax_nopriv_tribe_dropdown. This makes it possible for unauthenticated attackers to extract potentially sensitive data including post titles and IDs of pending, private and draft posts.
Configurations

Configuration 1 (hide)

cpe:2.3:a:stellarwp:the_events_calendar:*:*:*:*:*:wordpress:*:*

History

07 Oct 2024, 12:08

Type Values Removed Values Added
CPE cpe:2.3:a:tri:the_events_calendar:*:*:*:*:*:wordpress:*:* cpe:2.3:a:stellarwp:the_events_calendar:*:*:*:*:*:wordpress:*:*
First Time Stellarwp the Events Calendar
Stellarwp

12 Feb 2024, 20:49

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 5.3
First Time Tri
Tri the Events Calendar
References () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3010104%40the-events-calendar%2Ftags%2F6.2.9&old=3010096%40the-events-calendar%2Ftags%2F6.2.9 - () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3010104%40the-events-calendar%2Ftags%2F6.2.9&old=3010096%40the-events-calendar%2Ftags%2F6.2.9 - Product
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/fc40196e-c0f3-4bc6-ac4b-b866902def61?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/fc40196e-c0f3-4bc6-ac4b-b866902def61?source=cve - Third Party Advisory
CWE NVD-CWE-noinfo
CPE cpe:2.3:a:tri:the_events_calendar:*:*:*:*:*:wordpress:*:*

05 Feb 2024, 22:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-02-05 22:15

Updated : 2024-10-07 12:08


NVD link : CVE-2023-6557

Mitre link : CVE-2023-6557

CVE.ORG link : CVE-2023-6557


JSON object : View

Products Affected

stellarwp

  • the_events_calendar