The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. (e.g. draft, private, pending review, password-protected, and trashed posts).
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Event Tickets Plus Plugin | — | Update event-tickets-plus plugin to version 5.9.1, or a newer patched version | May 15, 2025 | Feb 8, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub