CVE-2024-11134 is a missing authorization vulnerability (CWE-862) in the Eventer - WordPress Event & Booking Manager Plugin by imithemes. The vulnerability arises because the 'eventer_export_bookings_csv' function does not perform a capability check, allowing any authenticated user with subscriber-level permissions or higher to export booking data containing personal customer information. This could lead to unauthorized data disclosure. The vulnerability affects all versions up to 3.9.9. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring low privileges but no user interaction, and impacting confidentiality only.

Authenticated users with subscriber-level or higher permissions can access and download booking data containing customers' personal information without proper authorization. This results in unauthorized disclosure of personal data, potentially violating privacy and data protection policies. There is no indication of impact on data integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user permissions where possible and monitor access to the export functionality. Consider disabling or restricting the 'eventer_export_bookings_csv' function if feasible to prevent unauthorized data export.