RSVP and Event Management Plugin, CVE-2022-1054

CVE, Research URL: CVE-2022-1054
Home page URL: Security reports for RSVP and Event Management Plugin
Application: RSVP and Event Management Plugin
Published on: Apr 18, 2022
Research Description: The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and has the export function hooked to the init action. As a result, unauthenticated attackers could call it and retrieve PII such as first name, last name and email address of user registered for events
Affected versions: max 2.7.5.
Status: vulnerable