Unauthorized Access Vulnerability in Eventer Plugin for WordPress

CVE-2024-11134

What is CVE-2024-11134?

The Eventer plugin for WordPress is affected by a vulnerability that allows unauthorized access to sensitive data due to a missing capability check in the 'eventer_export_bookings_csv' function. Authenticated attackers with subscriber-level permissions or higher can exploit this weakness to download booking records, which may include personal identifiers of customers. This issue is present in all versions of the plugin up to and including version 3.9.9, posing a significant risk of personal data exposure for users.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References