The Events Calendar < 6.15.10 - Unauthenticated Sensitive Information Exposure

Description

The pluign is vulnerable to information disclosure. The sysinfo REST endpoint compares the provided key to the stored opt-in key using a loose comparison, allowing unauthenticated attackers to send a boolean value and obtain the full system report whenever "Yes, automatically share my system information with The Events Calendar support team" setting is enabled.