A missing authorization vulnerability in the themefunction Event Manager, Event Calendar and Booking Plugin allows unauthenticated remote attackers to access restricted information, posing a high risk to data confidentiality.

This is a CWE-862 Missing Authorization flaw where the software fails to perform proper capability checks on sensitive functions. The vulnerability is exploitable by unauthenticated attackers over the network with no user interaction required.

Successful exploitation of this vulnerability allows unauthorized access to sensitive data managed by the plugin. Given the CVSS score of 7.5, this is considered a high-severity risk that could lead to significant information disclosure and a breach of privacy for user or event data.

Immediate Action: Monitor the vendor for the release of a security update that addresses this authorization flaw and apply it as soon as it becomes available.

Proactive Monitoring: Review plugin access logs for unusual patterns of request frequency or unauthorized attempts to access event management endpoints.

Compensating Controls: If a patch is not yet available, consider restricting access to the WordPress administrative dashboard and plugin-specific endpoints via a Web Application Firewall (WAF) or by limiting access to known administrative IP addresses.

Public Exploit Available: Unknown.

Organizations utilizing this plugin must prioritize this vulnerability and maintain a high state of vigilance until a vendor-supplied patch is deployed. Verify if your current version is within the affected range and implement network-level restrictions to minimize the exposure of the vulnerable plugin components to the public internet.