EUVD-2026-57074
GHSA-cj36-48gw-w6x2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Fully remote unauthenticated HTTP endpoint (AV:N/PR:N/AC:L/UI:N); high integrity from unrestricted account creation; C:L for incidental account enumeration exposure only.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records.
Articles & Coverage 1
AnalysisAI
Unauthenticated account creation in the Eventin WordPress plugin (all versions before 4.1.20) allows any remote attacker to register arbitrary email addresses as WordPress user accounts and inject order records by exploiting a missing authorization check on the waiting-list registration handler. The dual impact - rogue account creation and order record injection - can be chained with WordPress's built-in password reset flow to achieve full account takeover for any email address on the system. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target WordPress site must be running the Eventin plugin in a version prior to 4.1.20, with at least one event configured to use the waiting-list feature (this is a standard, not non-default, plugin capability). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.2 High score reflects a fully remote, zero-complexity, unauthenticated (AV:N/AC:L/PR:N/UI:N) attack path with high integrity impact - a combination that warrants immediate attention. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends a crafted unauthenticated HTTP POST request to the Eventin waiting-list handler, supplying a target victim's email address (e.g., a site administrator) as the registrant; the plugin creates a WordPress user account for that email without any authorization check. The attacker then triggers WordPress's native password reset for the newly created account, delivering a reset link to the victim's inbox - or, if the attacker controls the email address, directly sets a password and logs in. … |
| Remediation | Vendor-released patch: Eventin 4.1.20. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress instances running Eventin and disable the plugin to block exploitation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Eventin WordPress plugin versions before 4.1.20 exposes stored customer records - including names and email addresses -
Broken authorization in the Eventin WordPress plugin before 4.1.16 lets unauthenticated visitors create orders and suppl
Local file inclusion in the Eventin WordPress plugin (all versions before 4.1.20) allows authenticated users holding edi
Eventin WordPress plugin versions from 4.1.9 through 4.1.19 exposes customer order records - including personal informat
Unauthenticated information disclosure in the Eventin WordPress plugin before 4.1.22 exposes private, draft, and pending
Unauthenticated payment bypass in the Eventin WordPress plugin before 4.1.19 lets any visitor fraudulently obtain valid
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to Local File In
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to Local File In
Reflected cross-site scripting in the Eventin WordPress plugin up to version 4.0.28 allows unauthenticated attackers to
Blind server-side request forgery in the Eventin WordPress plugin prior to version 4.1.21 allows contributor-level authe
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themewinter
The Event Manager, Events Calendar, Events Tickets for WooCommerce - Eventin plugin for WordPress is vulnerable to unaut
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today