Medium severity5.3NVD Advisory· Published Feb 3, 2025· Updated Jun 17, 2026

CVE-2024-11133

Description

The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handle_pdf_download_request' function in all versions up to, and including, 3.9.9.5. This makes it possible for unauthenticated attackers to download event tickets.

Affected products

Imithemes/Eventer
cpe:2.3:a:imithemes:eventer:*:*:*:*:*:wordpress:*:*
Range: <=3.9.9
WordPress/Eventerllm-fuzzy
Range: <=3.9.9.5
Package: https://wordpress.org/plugins/eventer

Patches

Vulnerability mechanics

References

www.wordfence.com/threat-intel/vulnerabilities/id/1d78b823-fdff-41b2-8059-6564e3eb668dnvdThird Party Advisory
codecanyon.net/item/eventer-wordpress-event-manager-plugin/20972534nvdProduct

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000