CVE-2024-1122 in Event Manager, Events Calendar, Events Tickets for WooCommerce Plugin
Summary
by MITRE • 02/09/2024
The Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_data() function in all versions up to, and including, 3.3.50. This makes it possible for unauthenticated attackers to export event data.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/12/2026
The vulnerability identified as CVE-2024-1122 affects the Eventin plugin for WordPress, specifically targeting the Event Manager, Events Calendar, and Events Tickets for WooCommerce components. This issue resides within the plugin's export_data() function where a critical missing capability check has been discovered. The flaw exists across all versions up to and including 3.3.50, making it a widespread concern for WordPress site administrators who have deployed this plugin. The vulnerability represents a significant security weakness that directly impacts the confidentiality and integrity of event-related data stored within WordPress installations.
The technical flaw stems from the absence of proper access control validation within the export_data() function implementation. When an attacker invokes this function, no authentication or authorization checks are performed to verify whether the requester possesses the necessary privileges to access or export event data. This missing capability check creates an unauthorized access vector that allows any individual, regardless of their authentication status, to execute the export functionality and retrieve sensitive event information. The vulnerability operates at the application logic level, where proper privilege validation should occur but fails to do so, resulting in a direct breach of the principle of least privilege.
The operational impact of this vulnerability is substantial as it enables unauthenticated attackers to systematically extract event data from compromised WordPress installations. This includes potentially sensitive information such as event titles, descriptions, dates, locations, ticket sales data, and attendee information that may contain personal identifiers. The exposure of such data could lead to privacy violations, competitive intelligence theft, and potential social engineering opportunities for threat actors. The vulnerability affects not only individual event details but also aggregate data that could be valuable for malicious purposes including targeted attacks, spam campaigns, or data monetization activities.
Organizations should immediately implement mitigations including updating to the latest version of the Eventin plugin where this vulnerability has been addressed through proper capability checks and authentication requirements. Additionally, administrators should review their current plugin versions and ensure all WordPress installations are running patched versions. Network monitoring should be enhanced to detect unusual export activities, and access controls should be reviewed to limit unnecessary administrative privileges. The vulnerability aligns with CWE-284, which describes improper access control issues, and represents a clear violation of the ATT&CK technique T1213.002 for Data from Information Repositories. Security teams should also consider implementing web application firewalls and access control lists to provide additional defense-in-depth measures against similar unauthorized access attempts.