What is the CVSS score of CVE-2026-4109?

CVE-2026-4109 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-4109

EUVD-2026-22231 MEDIUM

Missing Authorization (CWE-862)

2026-04-14 Wordfence

Authentication Bypass WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 08:40 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 08:30 euvd

EUVD-2026-22231

Analysis Generated

Apr 14, 2026 - 08:30 vuln.today

CVE Published

Apr 14, 2026 - 07:43 nvd

MEDIUM 4.3

DescriptionCVE.org

The Eventin - Events Calendar, Event Booking, Ticket & Registration (AI Powered) plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the get_item_permissions_check() function in all versions up to, and including, 4.1.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary order data including customer PII (name, email, phone) by iterating order IDs.

AnalysisAI

Eventin - Events Calendar, Event Booking, Ticket & Registration plugin for WordPress fails to properly validate user capabilities in the get_item_permissions_check() function, allowing authenticated Subscriber-level users to enumerate and read arbitrary order data including customer names, emails, and phone numbers through order ID iteration. Affected versions include all releases up to and including 4.1.8. This is a low-complexity, network-accessible vulnerability (CVSS 4.3) that requires only basic authentication, making it exploitable by any user with a WordPress account on an affected site.

Technical ContextAI

The vulnerability stems from an improper capability check (CWE-862: Missing Authorization) in the Eventin plugin's REST API endpoint handling. The get_item_permissions_check() function fails to enforce proper permission validation before returning order objects via the API. WordPress capabilities are role-based access controls; Subscriber is the lowest user role with minimal permissions. By bypassing this check, attackers can directly access REST endpoints that return order data, which typically includes personally identifiable information (PII) such as customer names, email addresses, and phone numbers. The Eventin plugin, installed via the WordPress plugin repository (cpe:2.3:a:arraytics:eventin), is a widely-deployed event management solution, making this a high-exposure flaw. The vulnerability is exploited through standard HTTP requests to the WordPress REST API with valid but low-privilege authentication credentials.

RemediationAI

Update the Eventin plugin immediately to version 4.1.9 or later, which contains the capability check fix documented in WordPress plugin repository changeset 3501510. Organizations unable to update immediately should restrict REST API access to authenticated users through WordPress configuration or web application firewall rules, and monitor API logs for suspicious order data enumeration patterns. Verify the update by confirming the plugin version in the WordPress admin dashboard under Plugins. Additional details and confirmation of the fix are available in the Wordfence vulnerability report at https://www.wordfence.com/threat-intel/vulnerabilities/id/87f82d5d-d89a-440d-8c23-ace5160a0739?source=cve and the WordPress plugin changeset at https://plugins.trac.wordpress.org/changeset/3501510/.