The Events Calendar < 6.2.8.1 - Unauthenticated Arbitrary Password Protected Post Read

2023-11-2300:00:00

Krzysztof Zając (CERT PL)

events calendar

password protected

unauthenticated

arbitrary password

post read

exploit

source disclosure

AI Score

6.9

Confidence

Low

EPSS

0.001

Percentile

37.3%

JSON

Description The plugin discloses the content of password protected posts to unauthenticated users via a crafted request

Append "?view=single-event" to a password protected post, then view the source of the page and find the post content disclosed in <script type="application/ld+json">

Example: https://exmple.com/password-protected-post/?view=single-event