CVE-2024-2261

Event Tickets and Registration <= 5.8.2 - Improper Authorization to Information Disclosure

4.3 Medium

The Event Tickets and Registration plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.8.2 via the RSVP functionality. This makes it possible for authenticated attackers, with contributor access and above, to extract sensitive data including emails and street addresses.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

0.40%Up 0.4 points since Apr 10, 2024

What each source reports

CVE List Score used 4.3

Event Tickets and Registration <= 5.8.2 - Improper Authorization to Information Disclosure

Record: CVE-2024-2261
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-639
Updated: 2026-11-02

EUVDEUVD-2024-27216 4.3

Record: EUVD-2024-27216
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-v92r-jqh2-f2xx 4.3

The Event Tickets and Registration plugin for WordPress is vulnerable to Sensitive Information...

Record: GHSA-v92r-jqh2-f2xx
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-639
Updated: 2026-11-02

NVD 4.3

Record: CVE-2024-2261
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-639
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-2261 is a medium vulnerability (CVSS 4.3) in Stellarwp Event Tickets And Registration, published April 9, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. No source names a fixed version.