{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/eventon-free--2.2.8/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:myeventon:eventon:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":5.3,"id":"CVE-2024-0235"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Eventon Free (\u003c 2.2.8)","Eventon Premium (\u003c 4.5.5)"],"_cs_severities":["medium"],"_cs_tags":["wordpress","vulnerability","information-disclosure","eventon"],"_cs_type":"advisory","_cs_vendors":["Myeventon"],"content_html":"\u003cp\u003eCVE-2024-0235 is a vulnerability in the Myeventon Eventon plugin for WordPress that allows unauthenticated users to access sensitive information. An attacker can trigger the 'eventon_get_virtual_users' AJAX action via a crafted request to '/wp-admin/admin-ajax.php' to retrieve a list of user emails. Publicly available exploit tools indicate that this vulnerability is being targeted for mass scanning and enumeration by security researchers and potentially threat actors.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to the unauthorized disclosure of user email addresses, which facilitates subsequent targeted phishing, credential stuffing, or social engineering attacks against the organization's user base.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Myeventon Eventon to version 2.2.8 or later for free editions, or 4.5.5 or later for premium editions.\u003c/li\u003e\n\u003cli\u003eInspect web server access logs for repeated requests to '/wp-admin/admin-ajax.php' containing the parameter 'eventon_get_virtual_users'.\u003c/li\u003e\n\u003cli\u003eRestrict access to the WordPress administrative dashboard and associated AJAX endpoints to known, trusted IP ranges where possible.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-23T05:22:41Z","date_published":"2026-10-23T05:22:41Z","id":"https://feed.craftedsignal.io/briefs/2026-10-myeventon-eventon-cve-2024-0235/","summary":"CVE-2024-0235 is an unauthenticated information disclosure vulnerability in the Myeventon Eventon plugin that allows remote attackers to enumerate user email addresses via the 'eventon_get_virtual_users' AJAX action.","title":"Myeventon Eventon: Unauthenticated User Email Disclosure (CVE-2024-0235)","url":"https://feed.craftedsignal.io/briefs/2026-10-myeventon-eventon-cve-2024-0235/"}],"language":"en","title":"CraftedSignal Threat Feed - Eventon Free (\u003c 2.2.8)","version":"https://jsonfeed.org/version/1.1"}