The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) WordPress plugin by arraytics suffers from a missing capability check in its export_data() function in all versions up to 3.3.50. This CWE-862 vulnerability allows unauthenticated attackers to export event data without authorization. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality impact. No official patch or mitigation details are currently available.

The vulnerability allows unauthorized disclosure of event data by unauthenticated attackers due to missing authorization checks. There is no impact on data integrity or system availability. The exposure is limited to confidentiality of event-related information managed by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin's export functionality and monitor for updates from the vendor. Avoid exposing the plugin to untrusted users or the public internet where possible.