{
 "id": "WPSEC-2026-2438",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2438/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2438/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2438/index.md",
 "title": "Event Tickets and Registration <= 5.30.3 - Unauthenticated Sensitive Information Exposure via REST API Attendee Listings",
 "description": "The Event Tickets and Registration plugin for WordPress is vulnerable to Sensitive Information Exposure via the REST API attendee endpoints in all versions up to, and including, 5.30.3, due to insufficient visibility checks. The single-attendee endpoint read the '_tribe_hide_attendees_list' meta with inverted logic, which this plugin stores as 1 when the attendee list is shown. As a result it served attendees of events that do not display a public attendee list, which is the default. The attendee archive also did not exclude attendees of password-protected posts. This makes it possible for unauthenticated attackers to view attendee information for events whose attendee lists are hidden or password-protected.",
 "plugin": {
  "slug": "event-tickets",
  "name": "Event Tickets and Registration",
  "full_name": "Event Tickets and Registration",
  "wordpress_org": "https://wordpress.org/plugins/event-tickets/",
  "advisories_url": "https://wpsec.com/vuln/plugin/event-tickets/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/event-tickets"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.8",
    "from_inclusive": true,
    "to": "5.30.3.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.8 before 5.30.3.1"
  ]
 },
 "introduced_in": "4.8",
 "fixed_in": "5.30.3.1",
 "remediation": "Update to 5.30.3.1 or later.",
 "fix_released": "2026-11-02T21:53:42+00:00",
 "published": "2026-11-03T22:43:40+00:00",
 "updated": "2026-11-03T13:19:24.061427+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2438/",
  "https://plugins.svn.wordpress.org/event-tickets/tags/5.30.3.1/",
  "https://wordpress.org/plugins/event-tickets/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/event-tickets",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-04"
 }
}