EUVD-2026-71868
GHSA-88pj-jf5h-6qhv
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Contributor-level access (PR:L, not vendor-stated PR:H) suffices per description; no confidentiality or availability impact, only integrity via unauthorized REST writes.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event and speaker taxonomy terms they should not be able to manage.
AnalysisAI
Missing authorization on Eventin's event-management REST routes allows low-privilege WordPress contributors to perform integrity-impacting actions outside their permitted scope. Affected installations running Eventin before 4.1.22 expose endpoints that let contributor-role users redirect the site's public front page to an arbitrary event they do not own, and create, edit, or delete global event and speaker taxonomy terms site-wide. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target WordPress site must have the Eventin plugin installed and active in a version prior to 4.1.22. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector (PR:H) directly conflicts with the vulnerability description, which states that contributor-level access suffices - Contributors are low-privilege users in WordPress (PR:L is the accurate metric for this role). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Eventin WordPress plugin to version 4.1.22 or later, which introduces proper authorization checks on the affected REST routes per the WPScan advisory (https://wpscan.com/vulnerability/b1906fd4-82ab-435f-bb07-e8f2db402029/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Incorrect Privilege Assignment vulnerability in Themewinter Eventin allows Privilege Escalation.0.26. Rated critical sev
Unauthenticated account creation in the Eventin WordPress plugin (all versions before 4.1.20) allows any remote attacker
Eventin WordPress plugin versions before 4.1.20 exposes stored customer records - including names and email addresses -
Relative Path Traversal vulnerability in Themewinter Eventin allows Path Traversal.0.26. Rated high severity (CVSS 7.5),
Broken authorization in the Eventin WordPress plugin before 4.1.16 lets unauthenticated visitors create orders and suppl
Local file inclusion in the Eventin WordPress plugin (all versions before 4.1.20) allows authenticated users holding edi
Eventin WordPress plugin versions from 4.1.9 through 4.1.19 exposes customer order records - including personal informat
Local file inclusion in Eventin WordPress plugin before 4.1.21 enables authenticated contributors and higher-privileged
Unauthenticated information disclosure in the Eventin WordPress plugin before 4.1.22 exposes private, draft, and pending
Unauthenticated payment bypass in the Eventin WordPress plugin before 4.1.19 lets any visitor fraudulently obtain valid
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to Local File In
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to Local File In
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today