EUVD-2026-80192
GHSA-mc5w-3m87-prj3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain contributor account on site
-
DeliveryInvoke unprotected add-speaker function
-
ExploitCreate account with elevated capabilities
-
ExecutionSet attacker-controlled email
-
PersistRecover login for new account
-
ImpactPublish content / upload files as escalated user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account of contributor role or higher on a site running Eventin before 4.1.24; the add-speaker feature must be reachable to that role. The attacker must supply an email address they control to obtain a working login to the newly created account. Limiting factors: valid low-privilege credentials are needed (not fully unauthenticated), and the capabilities gained are elevated but bounded to author-level (publish content, upload files) rather than full administrator/site takeover. |
| Impact | This is a broken-access-control privilege-escalation flaw (CWE-862), not the 'Authentication Bypass' its tag suggests. The vendor CVSS of 2.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) understates real risk in one key metric: it uses PR:H, but the description explicitly says exploitation only requires contributor-level access, which is a LOW-privilege WordPress role - so PR:L is more accurate, raising the base score to roughly 4.3. The impact is genuine privilege escalation: a contributor creates a new user account carrying capabilities beyond their own (publishing content, uploading files - effectively author-level), and by supplying an attacker-controlled email obtains a working login to that account. Exploitation signals are modest and non-urgent: EPSS is 0.17% (7th percentile), there is NO CISA KEV listing, and while publicly available exploit code exists (WPScan), POC availability is a distinct signal from active exploitation and none is confirmed. Net: a legitimate authenticated privilege-escalation issue worth patching on popular multi-author sites, but not a drop-everything emergency - real-world risk is bounded by the requirement for an existing contributor account and the limited (author-level, not admin) capabilities gained. |
| Exploit ScenarioDerived | An attacker who already holds (or registers for) a contributor account on an Eventin-enabled WordPress site uses the 'add speaker' function to create a brand-new user account provisioned with capabilities beyond contributor - able to publish posts and upload files. By setting the new account's email to an address they control, they complete a password/login flow and gain interactive access to the higher-privileged account. Public exploit code exists via WPScan, lowering the skill barrier. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Broken access control in the Eventin WordPress plugin before 4.1.24 lets an authenticated contributor (or any higher role) create brand-new WordPress user accounts through the plugin's add-speaker functionality, and by supplying an email address they control, convert that into a working login to an account holding capabilities greater than their own - notably publishing content and uploading files. The flaw is a missing-authorization issue (CWE-862), so valid low-privilege credentials are a prerequisite; the tag 'Authentication Bypass' overstates it, and the privilege gained is author-level rather than full site takeover. The vendor has released a fix (4.1.24) and publicly available exploit code exists, while the EPSS score remains low at 0.17% (7th percentile), consistent with a bounded-impact, authenticated attack surface.
RemediationAI
Upgrade Eventin to version 4.1.24 or later, the first release outside the affected range; the vendor has published a fix, so no version-invention or guesswork is required. If the update cannot be applied immediately, actionable compensating controls are: audit and remove or down-rank any contributor accounts that do not strictly need them, since the entire exploit requires contributor-level credentials; and constrain the plugin's speaker-creation path so it performs a capability check - achievable by filtering the relevant capability via a small must-use plugin or an application-level WAF rule that blocks the speaker-add AJAX/REST request for users lacking 'create_users' (the trade-off being that legitimate organizers holding only contributor rights will no longer be able to add speakers). WordPress sites should also treat this as an account-integrity problem rather than a content problem: enumerate existing users for unexpected author-level accounts created after plugin installation, review those accounts' email addresses for attacker-controlled domains, and remove them, then enable new-user notification to catch repeat abuse. Deleting the plugin outright also closes the issue but removes all event functionality. Note the availability of public exploit code, so exposure should be treated as time-sensitive even though the EPSS score is low; the reference advisory should be consulted for any vendor-published interim guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Eventin is a WordPress event-management plugin whose speaker administration flow creates WordPress user records on behalf of event organizers. The affected code path adds a speaker and, as part of that operation, calls WordPress user-creation functions without first performing a capability check - the classic root cause of CWE-862 (Missing Authorization). WordPress core protects user creation behind capability checks such as current_user_can('create_users') and role elevation behind 'promote_users'; here those gates are absent, so the server accepts the request from a session that merely holds contributor-level rights. The resulting account is provisioned with a role/capability set that exceeds the requester's own (author-level: publish_posts, upload_files), creating both a privilege-escalation and a persistence vector. Because the attacker can specify the account email, they can complete WordPress's password-reset flow and authenticate as the newly created user. The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N confirms a remotely reachable, low-complexity, network-vector issue that requires only low privileges and produces integrity impact only - no confidentiality or availability loss - which matches an unauthorized account-creation primitive rather than a code-execution or data-exfiltration flaw. Note that the supplied CPE (cpe:2.3:a:unknown:eventin:*:*:*:*:*:*:*:*) has an unresolved vendor field, so CPE-based inventory matching should be supplemented with a direct check of the plugin's installed version in wp-content/plugins.
Know when Eventin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Contributor role suffices (PR:L not PR:H); no confidentiality impact and integrity limited to creating author-level accounts (I:L); no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and above to create new WordPress user accounts that carry capabilities beyond their own, including publishing content and uploading files, and, by supplying an email address they control, to obtain a working login to the created account.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Incorrect Privilege Assignment vulnerability in Themewinter Eventin allows Privilege Escalation.0.26. Rated critical sev
Unauthenticated account creation in the Eventin WordPress plugin (all versions before 4.1.20) allows any remote attacker
Eventin WordPress plugin versions before 4.1.20 exposes stored customer records - including names and email addresses -
Relative Path Traversal vulnerability in Themewinter Eventin allows Path Traversal.0.26. Rated high severity (CVSS 7.5),
Broken authorization in the Eventin WordPress plugin before 4.1.16 lets unauthenticated visitors create orders and suppl
Local file inclusion in the Eventin WordPress plugin (all versions before 4.1.20) allows authenticated users holding edi
Eventin WordPress plugin versions from 4.1.9 through 4.1.19 exposes customer order records - including personal informat
Local file inclusion in Eventin WordPress plugin before 4.1.21 enables authenticated contributors and higher-privileged
Missing authorization in the Eventin WordPress plugin before 4.1.24 allows unauthenticated attackers to reuse the order-
Unauthenticated information disclosure in the Eventin WordPress plugin before 4.1.22 exposes private, draft, and pending
Unauthenticated payment bypass in the Eventin WordPress plugin before 4.1.19 lets any visitor fraudulently obtain valid
Unauthenticated visitors can mark unpaid Eventin orders of any value as paid by replaying a single genuine low-value pay
Exploit-DB