CVE-2024-1124 is a missing authorization vulnerability (CWE-862) in the EventPrime – Events Calendar, Bookings and Tickets WordPress plugin by metagauss. The vulnerability arises from the lack of a capability check in the ep_send_attendees_email() function, allowing authenticated users with minimal privileges (subscriber-level and above) to send arbitrary emails with arbitrary content from the site. This issue affects all versions up to and including 3.4.1. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting its medium severity and the requirement for authenticated access. No patch or official fix information is currently available.

An attacker with subscriber-level access or higher can exploit this vulnerability to send arbitrary emails from the affected WordPress site. This could be leveraged to conduct phishing campaigns or spam attacks using the trusted domain, potentially damaging the site's reputation. The vulnerability does not allow direct compromise of data confidentiality or system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for suspicious email activity originating from the site. Avoid granting subscriber-level or higher access to untrusted users.