CVE-2024-1053: 
WordPress vulnerability analysis and mitigation

The Event Tickets and Registration plugin for WordPress contains a vulnerability (CVE-2024-1053) due to a missing capability check on the 'email' action in versions up to and including 5.8.1. This security flaw was discovered and reported by Wordfence, with the vulnerability being publicly disclosed on February 22, 2024 (NVD).

The vulnerability stems from a missing authorization check in the plugin's email functionality. The issue has been assigned a CVSS v3.1 base score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified as CWE-862 (Missing Authorization) (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to email the attendees list to themselves, potentially leading to unauthorized access to sensitive attendee information (NVD).

The vulnerability requires an authenticated user with at least contributor-level access to exploit. The attack complexity is considered low, requiring no user interaction to execute (NVD).

The vulnerability has been patched in version 5.8.2 of the Event Tickets and Registration plugin. Users are advised to update to this version or later to protect against potential exploitation (Patch).