EUVD-2026-66265
GHSA-fpv5-766g-3798
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network access with no complexity; confidentiality-only impact limited to non-public post content, no integrity or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces, allowing unauthenticated users to retrieve draft, pending and private posts belonging to other users, along with the passwords and contents of password-protected ones.
AnalysisAI
Unauthenticated information disclosure in the Eventin WordPress plugin before 4.1.22 exposes private, draft, and pending posts - including the plaintext passwords and full content of password-protected posts - to any unauthenticated HTTP client via an unprotected REST API namespace. The flaw arises from missing authorization checks on post status and ownership within that namespace, meaning no credentials or privileges are required to enumerate and read content the site owner intended to restrict. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required for exploitation: the Eventin plugin (any version before 4.1.22) simply needs to be installed and active on a WordPress site accessible over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 (Medium) score reflects a purely confidentiality-limited, unauthenticated network-accessible flaw with no integrity or availability impact - consistent with the actual behavior described. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends HTTP GET requests to the vulnerable Eventin REST API namespace endpoint - no credentials, tokens, or prior reconnaissance of user accounts required. The attacker enumerates and downloads the full content of all draft, pending, private, and password-protected posts, including their plaintext access passwords. … |
| Remediation | Update the Eventin WordPress plugin to version 4.1.22 or later, which is confirmed as the patched release per the vendor advisory referenced in the WPScan report at https://wpscan.com/vulnerability/1b2d4b55-1b7e-4150-8f90-492f7a3d5400/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated account creation in the Eventin WordPress plugin (all versions before 4.1.20) allows any remote attacker
Eventin WordPress plugin versions before 4.1.20 exposes stored customer records - including names and email addresses -
Broken authorization in the Eventin WordPress plugin before 4.1.16 lets unauthenticated visitors create orders and suppl
Local file inclusion in the Eventin WordPress plugin (all versions before 4.1.20) allows authenticated users holding edi
Eventin WordPress plugin versions from 4.1.9 through 4.1.19 exposes customer order records - including personal informat
Unauthenticated payment bypass in the Eventin WordPress plugin before 4.1.19 lets any visitor fraudulently obtain valid
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to Local File In
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to Local File In
Reflected cross-site scripting in the Eventin WordPress plugin up to version 4.0.28 allows unauthenticated attackers to
Blind server-side request forgery in the Eventin WordPress plugin prior to version 4.1.21 allows contributor-level authe
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themewinter
The Event Manager, Events Calendar, Events Tickets for WooCommerce - Eventin plugin for WordPress is vulnerable to unaut
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today