Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Event Access. The plugin lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id.
