CVE-2024-1127 is a vulnerability classified under CWE-862 (Missing Authorization) found in the EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress. The flaw exists in the booking_export_all() function, which lacks proper capability checks to verify if the requesting user has sufficient privileges to export all event booking data. As a result, any authenticated user with subscriber-level access or above can exploit this vulnerability to retrieve comprehensive booking information, including potentially sensitive personally identifiable information (PII) such as names, contact details, and booking specifics. The vulnerability affects all versions of the plugin up to and including 3.4.1. The CVSS v3.1 base score is 4.3, indicating a medium severity level, with an attack vector of network (remote), low attack complexity, requiring privileges (authenticated user), no user interaction, and limited impact on confidentiality (partial data disclosure), no impact on integrity or availability. No patches have been linked yet, and no active exploitation has been reported. This vulnerability is critical for organizations relying on this plugin for event management as it can lead to unauthorized data disclosure and potential privacy violations.

The primary impact of this vulnerability is unauthorized disclosure of event booking data, which may contain sensitive personal information. This can lead to privacy breaches, regulatory compliance issues (such as GDPR or CCPA violations), and reputational damage for organizations managing events. Attackers with subscriber-level access, which is a low privilege level in WordPress, can access data beyond their authorization scope, undermining trust in the platform's security. Although the vulnerability does not affect data integrity or availability, the exposure of PII can facilitate further attacks such as phishing, social engineering, or identity theft. Organizations using this plugin in sectors like education, entertainment, conferences, and public events are particularly at risk. The vulnerability's ease of exploitation and the widespread use of WordPress make this a notable concern globally.

To mitigate this vulnerability, organizations should immediately update the EventPrime plugin to a patched version once available. Until a patch is released, administrators should restrict user roles and permissions, ensuring that only trusted users have subscriber-level or higher access. Implementing strict access controls and monitoring user activities related to event booking exports can help detect and prevent exploitation. Additionally, consider disabling the booking export functionality if it is not essential. Employing web application firewalls (WAFs) to detect and block suspicious requests targeting the booking_export_all() function can provide temporary protection. Regularly audit plugins for vulnerabilities and maintain an inventory of installed WordPress extensions to quickly respond to emerging threats. Finally, educate users about the risks of unauthorized data access and enforce strong authentication policies.