Eventin WordPress Plugin EUVD-2026-78298

Two specific conditions must both be true simultaneously: (1) the Eventin plugin (wp-event-solution) must be installed and active on the WordPress instance - a deactivated or absent plugin produces no malicious map_meta_cap callback; and (2) the WordPress user account holding user ID 1 - always the first registered account created during WordPress installation - must have been deliberately demoted to a non-administrator role such as subscriber, editor, contributor, or author as a deliberate hardening step. The description explicitly states that on default WordPress installations where user ID 1 retains the administrator role, no privilege escalation occurs because the account already holds all capabilities. The attacker must possess valid login credentials for the user ID 1 account regardless of its current role assignment. WooCommerce installation, specific PHP versions, or non-standard hosting configurations are not required. The vulnerability does not require any administrative action or interaction from another user to trigger.

The assigned CVSS 7.5 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-calibrated for this vulnerability. The High Attack Complexity (AC:H) correctly encodes the non-default, specific precondition - user ID 1 must have been deliberately demoted - which significantly constrains real-world exploitability. The description explicitly confirms that on default WordPress installations no incremental privilege gain occurs, meaning this issue only materialises in environments that have followed a specific hardening guidance pattern. PR:L reflects that the attacker must possess valid credentials for the user ID 1 account, not merely network access. The full C:H/I:H/A:H impact is accurate for those environments where the precondition is met, as the attacker gains full administrative control including server-side RCE. No EPSS score, KEV listing, or confirmed POC was provided in the input data, so exploitation probability beyond theoretical cannot be assessed. Security teams running hardened WordPress deployments with demoted user ID 1 accounts should treat this as a high-priority patch, while operators on default configurations face negligible incremental risk.

An attacker with knowledge that a target WordPress site uses Eventin and has demoted its user ID 1 account to subscriber-level logs into that account using stolen or guessed credentials. Because Eventin's PermissionManager returns 'exist' for all capability checks for user ID 1, the subscriber account passes the edit_plugins and edit_themes checks enforced by the WordPress admin interface, allowing direct navigation to Appearance > Theme Editor or Plugins > Plugin Editor and injection of arbitrary PHP into an active theme or plugin file, resulting in server-side code execution. No public exploit code has been confirmed at time of analysis, but the attack requires no technical tooling beyond a web browser.