Medium severity · published Apr 18, 2022
CVE-2022-1054
RSVP and Event Management < 2.7.8 - Unauthenticated Entries Export
5.3
CVSS
4.2%
EPSS
No
On KEV
Description
The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and has the export function hooked to the init action. As a result, unauthenticated attackers could call it and retrieve PII such as first name, last name and email address of user registered for events
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.2% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
RSVP and Event Management Plugin ·
2.7.2 before 2.7.2*; 2.7.8 before 2.7.8 · source: vendor
RA
Rsvp And Event Management · Wpchill
before 2.7.8 · source: NVD