Eventer WordPress Plugin Missing Authorization Vulnerability in Bookings Export

A vulnerability exists in the Eventer plugin for WordPress, all versions through 3.9.9, allowing unauthorized data access. The issue arises from a missing capability check in the 'eventer_export_bookings_csv' function. This flaw enables authenticated attackers with subscriber-level permissions or higher to download booking data containing personal information of customers.

Impact

Exploitation of this vulnerability allows for unauthorized access to personal data of customers through the export of booking information.

Remediation

Users can update to version 3.9.9.1 or a newer patched version to address this vulnerability.