CVE-2024-2261 is an authorization bypass vulnerability in the Event Tickets and Registration plugin for WordPress, affecting all versions up to 5.8.2. The flaw allows authenticated users with contributor or higher privileges to exploit the RSVP feature to extract sensitive information, including email addresses and physical addresses of attendees. This issue is categorized under CWE-639, indicating improper authorization checks related to user-controlled keys. The vulnerability does not affect availability or integrity but impacts confidentiality.

An attacker with contributor-level or higher access can retrieve sensitive personal information such as emails and street addresses of event attendees. This exposure compromises user privacy but does not affect system integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and monitor for suspicious activity related to the RSVP functionality. Avoid exposing sensitive RSVP data to users without appropriate authorization.