The Events Calendar WordPress Plugin Information Disclosure Vulnerability

A vulnerability allowing information disclosure has been identified in The Events Calendar plugin for WordPress, affecting versions through 6.15.9. The issue arises in the sysinfo REST endpoint, where a loose comparison is used to validate the opt-in key. This flaw enables unauthenticated attackers to send a boolean value and retrieve the complete system report, but only if the user has opted to share system information with The Events Calendar support team.

Impact

Exploitation of this vulnerability allows unauthenticated attackers to access sensitive system information from the WordPress site.

Remediation

Users can update to version 6.15.10 or a newer patched version to address this vulnerability.