CVE-2024-0236

Summary

CVE-2024-0236 is a vulnerability affecting the EventON plugin for WordPress. Before version 4.5.5 for self-hosted installations and version 2.2.7 for WordPress.com hosts, the plugin failed to implement proper authorization in an AJAX action. Consequently, unauthenticated users could exploit this weakness to retrieve the settings of arbitrary virtual events, potentially gaining access to sensitive information such as meeting passwords, which could be used to disrupt or eavesdrop on Zoom or other virtual event sessions. This vulnerability poses a significant risk to WordPress websites utilizing the EventON plugin for virtual events management and requires immediate attention and patching to prevent potential unauthorized access.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.