Unauthorized Access Vulnerability in Eventer Plugin for WordPress

CVE-2024-11134

What is CVE-2024-11134?

The Eventer plugin for WordPress is affected by a vulnerability that allows unauthorized access to sensitive data due to a missing capability check in the 'eventer_export_bookings_csv' function. Authenticated attackers with subscriber-level permissions or higher can exploit this weakness to download booking records, which may include personal identifiers of customers. This issue is present in all versions of the plugin up to and including version 3.9.9, posing a significant risk of personal data exposure for users.

References