Event monster < 1.4.4 - Information Exposure Via Visitors List Export

Description

The plugin is vulnerable to Information Exposure via the Visitors List Export file. During the export, a CSV file is created in the wp-content folder with a hardcoded filename that is publicly accessible. This makes it possible for unauthenticated attackers to extract data about event visitors, that includes first and last names, email, and phone number.