Hey folks! We’ve found a particularly nasty bug within Event Tickets but have patched it up and are eager to get this latest update in your hands.
We discovered that it was possible for a malicious formula (payload) to be injected into the data when completing the Full Name section of the ticket purchase form. Essentially, this opens up a potential scenario where downloading the attendee data CSV file from the WordPress admin and opening the file could trigger malicious code to run on a computer. Even though there were no reports of this actually happening and Excel will indeed warn you before running any of the code, we saw the possibility and decided to patch it up before it could become a thing.
In most cases, you will be able to take advantage of automated updates directly in WordPress to get this latest release, but if that’s unavailable for any reason, you can download Event Tickets 4.10.7.2 from the downloads page in your account then update manually.
Event Tickets 4.10.7.2
- Fix – Exclude formulas when exporting attendee reports to CSV.
Not Updated This Release
The following plugins have not been updated this release and will remain at the version numbers specified here:
- The Events Calendar 4.9.7
- Events Calendar Pro 4.7.6
- Event Tickets Plus 4.10.6
- Community Events 4.6.4
- Community Tickets 4.7
- Filter Bar 4.8.1
- Advanced Post Manager 4.5
- Eventbrite Tickets 4.6.2
- Image Widget 4.4.7
- Image Widget Plus 1.0.3
- GigPress 2.3.23
Jaime
View author page
