WordPress EventPrime plugin < 3.5.0 - Subscriber+ Arbitrary booking settings update vulnerability

Subscriber+ Arbitrary booking settings update vulnerability discovered by caon in WordPress Plugin EventPrime versions 3.5.0...

CVE-2024-4665 EventPrime – Events Calendar, Bookings and Tickets < 3.5.0 - Subscriber+ Arbitrary booking settings update

The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing users to change/cancel bookings for other users. Additionally, the feature is lacking a nonce...