## https://sploitus.com/exploit?id=WPEX-ID:D80DFE2F-207D-4CDF-8C71-27936C6318E5
1. ADMIN: Install Event Tickets
2. ADMIN: Install Event Tickets Plus (Event Tickets Plus required for this specific shortcode that exists in the Event Tickets code)
3. ADMIN: Create pages with each status: published, private, password-protected, draft, and trashed and add one RSVP that has an end sale date of 1 week from now
4. ADMIN: Go to those pages and RSVP for each one as the currently logged in admin
5. CONTRIBUTOR: Add shortcode to any post and specify/guess the user ID and save
6. CONTRIBUTOR: Preview the post and see all pages (of any status) you shouldn't have access to and for any user you shouldn't be able to see
Example shortcode: `[tribe-user-event-confirmations user="ANY_USER_ID"]`