Eventer WordPress Plugin Missing Capability Check Vulnerability Allowing Unauthenticated Ticket Downloads

A vulnerability exists in the Eventer plugin for WordPress, specifically in versions through 3.9.9.5, due to a lack of proper capability checks in the 'handle_pdf_download_request' function. This oversight allows unauthenticated users to download event tickets, unauthorized access to event ticket data.

Impact

Exploitation of this vulnerability allows for unauthorized downloading of event tickets, potentially leading to misuse of event registration or access privileges.

Remediation

Users can update to version 3.9.9.5.1 or a newer patched version to address this vulnerability.