Exposure of Sensitive Information to an Unauthorized Actor
class-calendar-generator.php
Authenticated (Contributor+) Information Disclosure
🧾 Detailed a Description
CVE-2025-8091 — Authenticated (Contributor+) Information Disclosure
Affected Component: get_single_event_data()
Attack Vector: Specify any event ID, including private or draft posts
Trigger: An authenticated user passes the target event ID to the API/endpoint
Impact: Disclosure of sensitive details from unpublished events created by an administrator, including title, full description, custom fields, location, and organizer information
PoC:
Login as a Contributor in some way.
Guess the sequential event ID and view private information using the following short code.[add_single_eventon id="xxxx"]
Running the preview causes information leakage.
❓Reason for the vulnerability
The post_type parameter is not properly validated, allowing retrieval of unintended post types including private or draft events.
Proposed Fix:
Explicitly whitelist the allowed post_type before executing the query.
Apply proper capability checks such as current_user_can('read_private_ajde_events') for private content.
Limit post_status to publish for users without the necessary privileges.
mooseloveti/eventon-lite-cve-report
