Eventin Event Calendar Event Registration Tickets Booking Ai Powered CVE-2026-4109

This vulnerability presents moderate real-world risk despite the moderate CVSS score. The CVSS 4.3 rating reflects network accessibility (AV:N), low attack complexity (AC:L), required authentication (PR:L), no user interaction (UI:N), and limited scope (S:U) with confidentiality impact only (C:L). The presence of an improper capability check (CWE-862) is a common and easily exploitable flaw. Attack complexity is low because enumeration of order IDs is trivial; order IDs are typically sequential integers, enabling automated iteration. The vulnerability requires only Subscriber-level authentication, achievable through a free account registration on any affected WordPress site. EPSS exploitation probability is not provided in input data, but the low barrier to entry and straightforward exploitation method suggest actionable real-world risk. This is not a high-CVSS-but-low-risk issue; the combination of easy authentication, trivial enumeration, and PII exposure makes this a credible privacy breach vector for sites hosting sensitive customer data. KEV status and POC availability are not explicitly stated in input, but the fix is documented in the WordPress plugin repository, indicating vendor acknowledgment and a likely proof-of-concept.

An attacker registers a free Subscriber account on a WordPress site running Eventin version 4.1.8 or earlier. Using a REST API client or automated script, the attacker queries the order endpoint with sequential order IDs, receiving full order details including customer names, emails, and phone numbers due to the missing capability check. Within minutes, the attacker can iterate through hundreds or thousands of orders, extracting a dataset of customer PII for phishing, social engineering, or resale on underground marketplaces.