CVE-2024-11133 Eventer <= 3.9.9.5 - Missing Authorization to Unauthenticated Event Ticket Download

What is CVE-2024-11133?

CVE-2024-11133 is a medium-severity missing authorization vulnerability in imithemes Eventer - WordPress Event & Booking Manager Plugin, published on 3 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handle_pdf_download_request' function in all versions up to, and including, 3.9.9.5. This makes it possible for unauthenticated attackers to download event tickets.

Weakness: CWE-862

Which versions are affected by CVE-2024-11133?

It affects 1 product.

Products include Imithemes Eventer.

How do I fix CVE-2024-11133?

No fix has been published for CVE-2024-11133 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-11133 being exploited?

There is no known exploitation of CVE-2024-11133 in the wild and no public exploit code.

Other vulnerabilities in imithemes Eventer - WordPress Event & Booking Manager Plugin

• CVE-2025-39481 WordPress Eventer plugin < 3.11.4 - SQL Injection vulnerability Critical 9.3
• CVE-2025-0959 Eventer - WordPress Event & Booking Manager Plugin <= 3.9.9.2 - Authenticated (Subscriber+) SQL Injection via reg_id High 8.8
• CVE-2024-11135 Eventer <= 3.9.8 - Unauthenticated SQL Injection via eventer_get_attendees High 7.5
• CVE-2025-22635 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imithemes Eventer eventer allows Refle High 7.1
• CVE-2024-10799 Eventer <= 3.9.7 - Authenticated (Subscriber+) Arbitrary File Read Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-q829-m43v-whx9.