WordPress Plugin Vulnerabilities

Event Tickets < 5.30.3.1 - Unauthenticated Attendee Name Disclosure via Single Attendee REST Endpoint

Description

The plugin does not correctly check whether an event displays a public attendee list before returning one of its attendees over the REST API, allowing unauthenticated users to retrieve the names of attendees of events that do not show a public attendee list.

Proof of Concept

Affects Plugins

Plugin icon
event-tickets
Fixed in 5.30.3.1

References

CVE
CVE-2026-122061

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Aaron - WellKnown
Submitter
Aaron - WellKnown
Submitter website
https://wellknown.info
Verified
Yes
WPVDB ID
a3546a21-e420-4482-8bbd-7d8f9b9c9b56

Timeline

Publicly Published
2026-11-09 (about 1 day ago)
Added
2026-11-09 (about 23 hours ago)
Last Updated
2026-11-09 (about 23 hours ago)

Other

Published
Title
Published
2026-08-05
Title
Login & Register Forms < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password Response
Published
2026-10-15
Title
ThirstyAffiliates < 3.12.1 - Unauthenticated Non-Public Affiliate Link Destination Disclosure and Click Statistic Injection
Published
2026-10-06
Title
Wallet System for WooCommerce < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosure via Export
Published
2026-11-09
Title
WP Directory Kit < 1.6.3 - Unauthenticated User Data and Contact Message Disclosure
Published
2026-10-30
Title
YITH WooCommerce Product Add-Ons < 4.34.1 - Unauthenticated Non-Public Product Data Disclosure