CVE-2024-0235 PoC — EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Email Address Disclosure

Source

Associated Vulnerability

Description

The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve email addresses of any users on the blog

Readme

# CVE-2024-0235-PoC
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve email addresses of any users on the blog


# Usage:

```
usage: CVE-2024-0235.py [-h] --url URL
CVE-2024-0235.py: error: the following arguments are required: --url/-u

C:\Users\Nxploit\Desktop\readmail>python CVE-2024-0235.py -help
usage: CVE-2024-0235.py [-h] --url URL

EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Email Address Disclosure.

options:
  -h, --help         show this help message and exit
  --url URL, -u URL  The base URL of the WordPress site.
```

File Snapshot

 [4.0K]  /data/pocs/c6e6fb0a2f113f48572d7022339c70e38fe21c48
├── [2.3K]  CVE-2024-0235.py
└── [ 670]  README.md

0 directories, 2 files

Remarks