CVE-2024-11134

MEDIUM

imithemes Eventer < 3.9.9 - Authenticated Unauthorized Data Access via eventer_export_bookings_csv

Title source: llm

Description

The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'eventer_export_bookings_csv' function in all versions up to, and including, 3.9.9. This makes it possible for authenticated attackers with subscriber-level permissions or above, to download bookings, which contains customers' personal data.

References (2)

Core 2

Core References

Product

https://codecanyon.net/item/eventer-wordpress-event-manager-plugin/20972534

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/476bc092-c623-4caf-9676-3036d27c4840?source=cve

Scores

CVSS v3 4.3

EPSS 0.0029

EPSS Percentile 21.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (2)

imithemes/eventer < 3.9.9.1

imithemes/Eventer - WordPress Event & Booking Manager Plugin < 3.9.9

Published Feb 03, 2025

Tracked Since Feb 18, 2026