This vulnerability in the themefunction WordPress Event Manager, Event Calendar and Booking Plugin (up to version 4.0.24) is due to missing authorization checks, which results in incorrect access control. An attacker can exploit this flaw remotely without authentication or user interaction to gain unauthorized access to sensitive information, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The issue is classified as a missing authorization vulnerability affecting the plugin's eventin-pro component.

The vulnerability allows remote attackers to access sensitive information without authentication, potentially leading to data exposure. There is no impact on integrity or availability reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the plugin's administrative interfaces and monitor for unusual activity related to the plugin. Avoid using affected versions in production environments if possible.