Myeventon Eventon: Unauthenticated User Email Disclosure (CVE-2024-0235)

CVE-2024-0235 is a vulnerability in the Myeventon Eventon plugin for WordPress that allows unauthenticated users to access sensitive information. An attacker can trigger the 'eventon_get_virtual_users' AJAX action via a crafted request to '/wp-admin/admin-ajax.php' to retrieve a list of user emails. Publicly available exploit tools indicate that this vulnerability is being targeted for mass scanning and enumeration by security researchers and potentially threat actors.

Impact

Successful exploitation leads to the unauthorized disclosure of user email addresses, which facilitates subsequent targeted phishing, credential stuffing, or social engineering attacks against the organization's user base.

Recommendation

• Update Myeventon Eventon to version 2.2.8 or later for free editions, or 4.5.5 or later for premium editions.
• Inspect web server access logs for repeated requests to '/wp-admin/admin-ajax.php' containing the parameter 'eventon_get_virtual_users'.
• Restrict access to the WordPress administrative dashboard and associated AJAX endpoints to known, trusted IP ranges where possible.