The plugin does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.
https://example.com/wp-admin/admin-ajax.php?action=eventon_ics_download&event_id=<any post id>