CVE-2024-1126 identifies a missing authorization vulnerability (CWE-862) in the EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress. The flaw exists in the get_attendees_email_by_event_id() function, which lacks proper capability checks to verify if the requesting user is authorized to access attendee email lists. This vulnerability affects all plugin versions up to and including 3.4.1. An attacker with authenticated subscriber-level access or higher can exploit this flaw to retrieve sensitive attendee email addresses for any event managed by the plugin. The vulnerability is remotely exploitable over the network without requiring elevated privileges or user interaction, increasing its risk profile. The CVSS v3.1 score is 5.3 (medium), reflecting the limited impact on confidentiality only, with no impact on integrity or availability. No patches or fixes have been linked yet, and no known exploits have been reported in the wild. The vulnerability highlights the importance of proper authorization checks in WordPress plugins handling sensitive user data.

The primary impact of this vulnerability is unauthorized disclosure of attendee email addresses, which compromises confidentiality. Attackers can harvest attendee contact information, potentially leading to phishing campaigns, spam, or social engineering attacks targeting event participants. While the vulnerability does not affect data integrity or availability, the exposure of personal information can damage organizational reputation and violate privacy regulations such as GDPR or CCPA. Organizations relying on EventPrime for event management may face increased risk of targeted attacks against their users. Since exploitation requires only subscriber-level access, any compromised or malicious user account can leverage this flaw, increasing the attack surface. The absence of known exploits reduces immediate risk but does not eliminate the threat, especially as attackers often reverse-engineer disclosed vulnerabilities.

Until an official patch is released, organizations should implement the following mitigations: 1) Restrict subscriber-level user registrations or closely monitor new accounts to reduce potential attacker footholds. 2) Limit plugin usage to trusted administrators and event managers only, disabling or removing it if not essential. 3) Employ web application firewalls (WAFs) to detect and block suspicious requests targeting the vulnerable function. 4) Monitor logs for unusual access patterns to attendee email data. 5) Educate users about phishing risks stemming from potential data leaks. 6) Once available, promptly apply vendor patches or updates addressing this vulnerability. 7) Review and harden WordPress user roles and capabilities to ensure least privilege principles are enforced. 8) Consider isolating event management functions on separate systems with stricter access controls to minimize exposure.