Access violation vulnerability in Event List 2.0.4

The Event List plugin for WordPress has a security issue that allows attackers with certain levels of access to gain more privileges than they should have. This problem affects all versions of the plugin up to and including 2.0.4. The issue is caused by the plugin not properly checking a user’s permissions before allowing them to update their profile. This means that attackers who have at least Subscriber-level access can change their permissions to that of an administrator.