Registrations for the Events Calendar < 2.12.2 - Missing Authorization

Description

The Registrations for the Events Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the rtec_process_form_submission() and rtec_records_edit() functions in versions up to, and including, 2.12.1. This makes it possible for authenticated attackers, with contributor-level access and above, to edit and register for events they should not have access to.