CVE-2024-13526

Name of the Vulnerable Software and Affected Versions EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress versions up to, and including, 4.0.7.3

Description The issue allows authenticated attackers with Subscriber-level access and above to access data without proper authorization. This is due to missing capability checks on the export submittion attendees function, enabling them to download the list of attendees for any event.

Recommendations For versions up to, and including, 4.0.7.3, consider disabling the export submittion attendees function until a patch is available to prevent unauthorized access to event attendee lists.