The Event Monster – Manager & Ticket Booking WordPress plugin (versions up to 1.4.3) suffers from an information exposure vulnerability (CWE-359) due to the creation of a CSV export file containing visitor personal data in the wp-content folder with a hardcoded filename. This file is publicly accessible without authentication, enabling unauthorized actors to retrieve sensitive visitor information including names, emails, and phone numbers. The vulnerability is rated medium severity with a CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). No patch or remediation details are provided in the available data.

Unauthorized actors can access personal information of event visitors such as first and last names, email addresses, and phone numbers by accessing a publicly available CSV export file. This exposure compromises visitor privacy but does not affect system integrity or availability. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict access to the wp-content folder or the specific CSV export file to prevent unauthorized access. Consider disabling the export functionality if possible or monitoring for updates from the vendor.