CVE-2024-0235: EventON WordPress Information Disclosure Flaw

CVE-2024-0235 Overview

CVE-2024-0235 affects the EventON WordPress plugin, a widely used events calendar solution. The vulnerability stems from a missing authorization check in an AJAX action handler. Unauthenticated attackers can invoke the vulnerable endpoint to retrieve email addresses of any registered user on the target blog. The flaw is classified under [CWE-862] Missing Authorization. It impacts EventON versions before 4.5.5 and legacy 2.x versions before 2.2.7.

Critical Impact
Unauthenticated attackers can harvest user email addresses from affected WordPress sites, enabling targeted phishing and credential-stuffing campaigns.

Affected Products

EventON WordPress plugin versions before 4.5.5
EventON WordPress plugin 2.x versions before 2.2.7
WordPress sites running the myeventon:eventon component

Discovery Timeline

2024-01-16 - CVE-2024-0235 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0235

Vulnerability Analysis

The EventON plugin exposes an AJAX action through the standard WordPress admin-ajax.php interface. The handler executes without verifying the caller's capabilities or authentication state. As a result, any anonymous visitor can invoke the action and request user data. The response includes email addresses belonging to registered accounts on the WordPress installation.

The issue falls into the broader class of Broken Access Control flaws common in WordPress plugin AJAX endpoints. Developers frequently register callbacks with wp_ajax_nopriv_ prefixes without adding capability checks or nonce validation. Attackers can automate collection at scale using simple HTTP clients.

Email harvesting increases the attack surface for downstream campaigns. Collected addresses enable spearphishing against site administrators and editors. They also feed credential-stuffing lists targeting the same accounts on other services.

Root Cause

The root cause is a missing authorization check within the vulnerable AJAX callback. The plugin does not call current_user_can() or validate a nonce before returning sensitive user data. This maps directly to [CWE-862] Missing Authorization.

Attack Vector

Exploitation requires only network access to the target WordPress site. The attacker sends a crafted POST or GET request to wp-admin/admin-ajax.php specifying the vulnerable EventON action. No authentication, user interaction, or elevated privileges are required. Technical details are documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2024-0235

Indicators of Compromise

Unexpected requests to wp-admin/admin-ajax.php referencing EventON-specific action parameters from unauthenticated sources
Bursts of AJAX requests from a single IP address or small pool of addresses enumerating user IDs
Web server logs showing large response payloads containing email address patterns returned to anonymous clients

Detection Strategies

Inspect access logs for repeated POST /wp-admin/admin-ajax.php requests without an authenticated session cookie
Deploy Web Application Firewall (WAF) rules that flag or block EventON AJAX actions when invoked without a valid nonce
Correlate outbound phishing campaigns targeting site users with prior anonymous AJAX traffic to identify successful harvesting

Monitoring Recommendations

Enable verbose WordPress access logging and forward events to a centralized SIEM for retention and search
Track plugin version inventory across all WordPress hosts to identify sites running EventON below 4.5.5 or 2.2.7
Alert on anomalous response sizes from admin-ajax.php that deviate from the normal baseline

How to Mitigate CVE-2024-0235

Immediate Actions Required

Upgrade EventON to version 4.5.5 or later, or 2.2.7 or later for legacy 2.x installations
Audit WordPress user accounts and notify users whose email addresses may have been exposed
Review web server logs for prior exploitation attempts against the vulnerable AJAX endpoint

Patch Information

The vendor addressed the vulnerability by adding proper authorization checks to the affected AJAX action. Site administrators should update through the WordPress plugin dashboard or download the latest release from the vendor. Confirm the installed version reports 4.5.5 or higher after patching.

Workarounds

Restrict access to wp-admin/admin-ajax.php at the WAF or reverse proxy level for EventON-specific action names until patching is complete
Temporarily deactivate the EventON plugin on sites that cannot immediately update
Enforce rate limiting on admin-ajax.php endpoints to slow automated enumeration attempts

bash

# Example WAF rule fragment to block unauthenticated EventON AJAX requests
# ModSecurity syntax
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1002024,msg:'Block unauthenticated EventON AJAX'"
  SecRule ARGS:action "@rx ^evo" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"