CVE-2024-11396: Unauthenticated information exposure vulnerability in the Event Monster WordPress plugin. This flaw allows attackers to download a publicly accessible CSV file containing sensitive user data, including names, emails, and phone numbers.

CVE-2024-11396 affects versions up to 1.4.3 of the Event Monster – Event Management, Tickets Booking, Upcoming Event plugin. The plugin creates an export file with a predictable name in a publicly accessible directory. While the CVSS score is 5.3, indicating a medium severity, the SVRS score is 52. This score, while not critical, indicates that this vulnerability warrants attention, especially given the sensitive nature of the exposed personal data. Successful exploitation allows unauthenticated attackers to harvest user data, potentially leading to phishing attacks, spam campaigns, or identity theft. Organizations using this plugin should update to a patched version immediately to mitigate this risk and protect user privacy. The issue stems from CWE-359 (Insufficiently Protected Resource).