Arraytics
Monthly
Local File Inclusion in the Eventin WordPress event management plugin (versions ≤4.1.22) allows authenticated contributors to include and execute arbitrary PHP files on the server via the unsanitized 'event_layout' parameter, achieving full remote code execution. The etn_manage_event capability is assigned to WordPress Contributors by default, meaning any registered Contributor can set the malicious parameter value through the REST API without any site-specific configuration change. Exploitation requires a PHP file to already be present on the server, reflected in the AC:H CVSS rating; no public exploit or CISA KEV listing has been identified at time of analysis.
Local File Inclusion in the Eventin Event Calendar WordPress plugin (all versions through 4.1.22) allows authenticated attackers with custom-level WordPress access to include and execute arbitrary PHP files by supplying a crafted path via the unsanitized `event_layout` parameter in the plugin's event template and REST API endpoints. Successful code execution requires the attacker to first place a PHP file on the server - a two-stage exploit chain reflected in the CVSS AC:H rating. No public exploit code or CISA KEV listing has been identified at time of analysis; Wordfence reported this with direct source code line references, indicating the attack surface is well-documented.
Blind SQL injection in the Booktics WordPress plugin (all versions through 1.0.22) enables authenticated low-privileged network attackers to systematically extract data from the underlying database. The CVSS Scope:Changed metric indicates data exposure extends beyond the plugin's own tables to the broader WordPress database, yielding a High confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and network accessibility make this a meaningful risk for any WordPress site running an affected version.
WP Event Solution WordPress plugin versions up to and including 4.1.19 allows authenticated users with customer-level privileges to delete arbitrary content due to missing authorization controls (CWE-862). The vulnerability is network-exploitable with low privilege requirements and no user interaction, yielding high availability impact through unrestricted content deletion. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Cross-Site Scripting in the Timetics WordPress appointment-booking plugin (by Arraytics) affects all versions up to and including 1.0.58, allowing unauthenticated remote attackers to inject script that executes in a victim's browser after the victim interacts with a crafted link or page. Because the CVSS scope is changed (S:C), a successful injection can affect resources beyond the vulnerable component, such as the browser session of a logged-in administrator. There is no public exploit identified at time of analysis, the CVE is not listed in CISA KEV, and no EPSS score was provided.
Unauthenticated PHP Object Injection in the Booktics WordPress plugin (by Arraytics) affects all versions up to and including 1.0.21, letting remote attackers with no authentication inject arbitrary PHP objects into the application. If a suitable POP (property-oriented programming) gadget chain exists in the plugin, WordPress core, or another active plugin, this can escalate to remote code execution, data theft, or full site takeover. Reported by Patchstack and rated CVSS 9.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated information disclosure in the Arraytics WP Event Solution (Eventin) WordPress plugin through version 4.1.8 allows remote attackers to bypass access control checks and read data they should not be permitted to access. The flaw was disclosed by Patchstack and tracked as EUVD-2026-36985; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Missing authorization in Timetics WordPress plugin through version 1.0.53 allows unauthenticated remote attackers to bypass access controls and access sensitive administrative functions or data. With CVSS 8.2 (High), the vulnerability enables high confidentiality impact and low integrity impact against network-accessible instances. Patchstack reported this broken access control flaw, indicating potential exposure of booking systems, customer data, or administrative operations to unauthorized access without authentication.
A missing authorization vulnerability exists in Arraytics WPCafe WordPress plugin versions up to 3.0.7, where incorrectly configured access control allows attackers to bypass authentication and authorization checks. This broken access control flaw (CWE-862) enables unauthorized users to perform actions they should not have permission to execute, potentially leading to unauthorized data access, modification, or plugin functionality abuse. The vulnerability affects all installations of WPCafe through version 3.0.7 and is tracked under ENISA EUVD ID EUVD-2026-15773 with confirmation from Patchstack vulnerability research.
Authorization bypass in the Eventin event management plugin for WordPress (all versions ≤ 4.1.22) enables attackers to fraudulently claim paid tickets, mark unprocessed orders as completed, deplete ticket inventory, and trigger confirmation emails - all without making payment. While the formal CVSS vector assigns PR:L (subscriber-level access), the CVE description explicitly confirms a fully unauthenticated exploitation path: the wp_rest nonce is emitted on every frontend page, and the order creation endpoint issues an order_access_token to any caller possessing that nonce, granting anonymous users the credential material to invoke the privileged update_booking_status branch. No public exploit code or CISA KEV listing has been identified at time of analysis; a patch changeset is referenced in the WordPress plugin repository.
Authorization bypass in Eventin - Event Calendar plugin for WordPress (all versions ≤4.1.17) allows authenticated subscriber-level users to fully manage notification flow automation workflows restricted to administrators. Exploitation requires only a low-privilege WordPress account, enabling unauthorized read, create, update, clone, and delete operations on event automation configurations. No public exploit or KEV listing identified; vendor-released patch 4.1.18 resolves the flaw.
Ticket inventory exhaustion in WP Event Solution (Eventin) ≤4.1.22 allows any unauthenticated visitor to forge completed event orders and permanently lock out legitimate ticket buyers. The REST endpoint /wp-json/eventin/v2/orders relies solely on a wp_rest nonce for authorization, but that nonce is broadcast to every site visitor via the etn-public script's localized_data_obj - making the check functionally equivalent to no check at all. By submitting crafted POST requests with status='completed', attackers create persistent fake sold-order records that count against ticket inventory indefinitely, since the auto-cleanup scheduler only targets pending orders. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the Timetics WordPress booking and scheduling plugin (versions ≤ 1.0.61) exposes unauthenticated REST or AJAX endpoints that lack authorization checks, allowing remote attackers to modify or disrupt scheduling data without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms straightforward network exploitation requiring no authentication or user interaction against any WordPress site running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis; real-world impact is bounded by the plugin's relatively limited deployment footprint.
Broken access control in WP Event Solution WordPress plugin (versions <= 4.1.22) exposes unauthenticated network attackers to unauthorized actions against event management functionality, resulting in partial integrity and availability impact. The CVSS vector (PR:N/UI:N/AC:L) confirms this is trivially exploitable by any internet-reachable attacker with no authentication or user interaction required. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low barrier to exploitation warrants prompt patching on public-facing WordPress installations.
Sensitive customer data exposure in the WP Event Solution WordPress plugin (versions up to and including 4.1.18) allows authenticated low-privileged users to access confidential customer information over the network. The vulnerability, classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), results in high confidentiality impact with no integrity or availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility elevate realistic risk for sites collecting customer data via this plugin.
Broken authentication in WP Event Solution WordPress plugin (versions ≤4.1.9) permits unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), resulting in limited information disclosure and partial integrity impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable over the network with no credentials and no user interaction required against any WordPress installation running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Authorization bypass in the Eventin WordPress plugin (versions 4.0.26-4.1.15) enables unauthenticated attackers to mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash to the payment_complete() REST endpoint. The wp_rest nonce required to reach this endpoint is embedded in the HTML of every public event page, eliminating any credential or session requirement. This is a confirmed regression - the same function and endpoint were previously patched by Arraytics, but the fix was lost in subsequent releases; no public exploit has been identified at time of analysis.
Stored cross-site scripting in the Eventin WordPress event management plugin (all versions through 4.1.15) lets any contributor-level user permanently embed malicious JavaScript in event FAQ sections via the unescaped `etn_faq_content` parameter. The CVSS scope change (S:C) confirms the impact crosses the attacker's security context - injected scripts execute in any visitor's browser who loads the affected event page, enabling session hijacking or credential harvesting of higher-privileged users including site administrators. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the low attack complexity and commonly granted contributor role make this a credible insider-threat risk on multi-user WordPress installations.
Authorization bypass in the WPCafe WordPress plugin (all versions through 3.0.14) allows any authenticated subscriber-level user to fully manage email notification flow workflows that are intended to be administrator-only. The FlowAPI REST endpoints bundled within the plugin's email notification SDK rely solely on a wp_rest nonce for access control - a token freely obtainable from the frontend page source by any logged-in user - completely bypassing role-based authorization. No public exploit or active exploitation has been identified at time of analysis, though the low exploitation complexity makes this a realistic risk on sites with open user registration.
Broken access control in the Arraytics WP Event Solution WordPress plugin through version 4.1.12 allows remote unauthenticated attackers to access protected functionality or data without authorization. The flaw stems from missing authorization checks (CWE-862) on plugin endpoints, exposing sensitive event-management capabilities or data to anyone who can reach the WordPress site. No public exploit identified at time of analysis, and the issue is not currently listed in the CISA KEV catalog.
Eventin - Events Calendar, Event Booking, Ticket & Registration plugin for WordPress fails to properly validate user capabilities in the get_item_permissions_check() function, allowing authenticated Subscriber-level users to enumerate and read arbitrary order data including customer names, emails, and phone numbers through order ID iteration. Affected versions include all releases up to and including 4.1.8. This is a low-complexity, network-accessible vulnerability (CVSS 4.3) that requires only basic authentication, making it exploitable by any user with a WordPress account on an affected site.
Missing authorization in Arraytics Booktics WordPress plugin through version 1.0.16 allows unauthenticated remote attackers to modify application data via incorrectly configured access control security levels. The vulnerability has a low EPSS score (0.02%, percentile 4) despite the network-accessible attack vector, suggesting limited real-world exploitation likelihood. No public exploit code or active CISA KEV status has been identified.
Missing Authorization vulnerability in Arraytics Timetics allows Accessing Functionality Not Properly Constrained by ACLs.0.23. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Local File Inclusion in the Eventin WordPress event management plugin (versions ≤4.1.22) allows authenticated contributors to include and execute arbitrary PHP files on the server via the unsanitized 'event_layout' parameter, achieving full remote code execution. The etn_manage_event capability is assigned to WordPress Contributors by default, meaning any registered Contributor can set the malicious parameter value through the REST API without any site-specific configuration change. Exploitation requires a PHP file to already be present on the server, reflected in the AC:H CVSS rating; no public exploit or CISA KEV listing has been identified at time of analysis.
Local File Inclusion in the Eventin Event Calendar WordPress plugin (all versions through 4.1.22) allows authenticated attackers with custom-level WordPress access to include and execute arbitrary PHP files by supplying a crafted path via the unsanitized `event_layout` parameter in the plugin's event template and REST API endpoints. Successful code execution requires the attacker to first place a PHP file on the server - a two-stage exploit chain reflected in the CVSS AC:H rating. No public exploit code or CISA KEV listing has been identified at time of analysis; Wordfence reported this with direct source code line references, indicating the attack surface is well-documented.
Blind SQL injection in the Booktics WordPress plugin (all versions through 1.0.22) enables authenticated low-privileged network attackers to systematically extract data from the underlying database. The CVSS Scope:Changed metric indicates data exposure extends beyond the plugin's own tables to the broader WordPress database, yielding a High confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and network accessibility make this a meaningful risk for any WordPress site running an affected version.
WP Event Solution WordPress plugin versions up to and including 4.1.19 allows authenticated users with customer-level privileges to delete arbitrary content due to missing authorization controls (CWE-862). The vulnerability is network-exploitable with low privilege requirements and no user interaction, yielding high availability impact through unrestricted content deletion. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Cross-Site Scripting in the Timetics WordPress appointment-booking plugin (by Arraytics) affects all versions up to and including 1.0.58, allowing unauthenticated remote attackers to inject script that executes in a victim's browser after the victim interacts with a crafted link or page. Because the CVSS scope is changed (S:C), a successful injection can affect resources beyond the vulnerable component, such as the browser session of a logged-in administrator. There is no public exploit identified at time of analysis, the CVE is not listed in CISA KEV, and no EPSS score was provided.
Unauthenticated PHP Object Injection in the Booktics WordPress plugin (by Arraytics) affects all versions up to and including 1.0.21, letting remote attackers with no authentication inject arbitrary PHP objects into the application. If a suitable POP (property-oriented programming) gadget chain exists in the plugin, WordPress core, or another active plugin, this can escalate to remote code execution, data theft, or full site takeover. Reported by Patchstack and rated CVSS 9.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated information disclosure in the Arraytics WP Event Solution (Eventin) WordPress plugin through version 4.1.8 allows remote attackers to bypass access control checks and read data they should not be permitted to access. The flaw was disclosed by Patchstack and tracked as EUVD-2026-36985; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Missing authorization in Timetics WordPress plugin through version 1.0.53 allows unauthenticated remote attackers to bypass access controls and access sensitive administrative functions or data. With CVSS 8.2 (High), the vulnerability enables high confidentiality impact and low integrity impact against network-accessible instances. Patchstack reported this broken access control flaw, indicating potential exposure of booking systems, customer data, or administrative operations to unauthorized access without authentication.
A missing authorization vulnerability exists in Arraytics WPCafe WordPress plugin versions up to 3.0.7, where incorrectly configured access control allows attackers to bypass authentication and authorization checks. This broken access control flaw (CWE-862) enables unauthorized users to perform actions they should not have permission to execute, potentially leading to unauthorized data access, modification, or plugin functionality abuse. The vulnerability affects all installations of WPCafe through version 3.0.7 and is tracked under ENISA EUVD ID EUVD-2026-15773 with confirmation from Patchstack vulnerability research.
Authorization bypass in the Eventin event management plugin for WordPress (all versions ≤ 4.1.22) enables attackers to fraudulently claim paid tickets, mark unprocessed orders as completed, deplete ticket inventory, and trigger confirmation emails - all without making payment. While the formal CVSS vector assigns PR:L (subscriber-level access), the CVE description explicitly confirms a fully unauthenticated exploitation path: the wp_rest nonce is emitted on every frontend page, and the order creation endpoint issues an order_access_token to any caller possessing that nonce, granting anonymous users the credential material to invoke the privileged update_booking_status branch. No public exploit code or CISA KEV listing has been identified at time of analysis; a patch changeset is referenced in the WordPress plugin repository.
Authorization bypass in Eventin - Event Calendar plugin for WordPress (all versions ≤4.1.17) allows authenticated subscriber-level users to fully manage notification flow automation workflows restricted to administrators. Exploitation requires only a low-privilege WordPress account, enabling unauthorized read, create, update, clone, and delete operations on event automation configurations. No public exploit or KEV listing identified; vendor-released patch 4.1.18 resolves the flaw.
Ticket inventory exhaustion in WP Event Solution (Eventin) ≤4.1.22 allows any unauthenticated visitor to forge completed event orders and permanently lock out legitimate ticket buyers. The REST endpoint /wp-json/eventin/v2/orders relies solely on a wp_rest nonce for authorization, but that nonce is broadcast to every site visitor via the etn-public script's localized_data_obj - making the check functionally equivalent to no check at all. By submitting crafted POST requests with status='completed', attackers create persistent fake sold-order records that count against ticket inventory indefinitely, since the auto-cleanup scheduler only targets pending orders. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the Timetics WordPress booking and scheduling plugin (versions ≤ 1.0.61) exposes unauthenticated REST or AJAX endpoints that lack authorization checks, allowing remote attackers to modify or disrupt scheduling data without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms straightforward network exploitation requiring no authentication or user interaction against any WordPress site running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis; real-world impact is bounded by the plugin's relatively limited deployment footprint.
Broken access control in WP Event Solution WordPress plugin (versions <= 4.1.22) exposes unauthenticated network attackers to unauthorized actions against event management functionality, resulting in partial integrity and availability impact. The CVSS vector (PR:N/UI:N/AC:L) confirms this is trivially exploitable by any internet-reachable attacker with no authentication or user interaction required. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low barrier to exploitation warrants prompt patching on public-facing WordPress installations.
Sensitive customer data exposure in the WP Event Solution WordPress plugin (versions up to and including 4.1.18) allows authenticated low-privileged users to access confidential customer information over the network. The vulnerability, classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), results in high confidentiality impact with no integrity or availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility elevate realistic risk for sites collecting customer data via this plugin.
Broken authentication in WP Event Solution WordPress plugin (versions ≤4.1.9) permits unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), resulting in limited information disclosure and partial integrity impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable over the network with no credentials and no user interaction required against any WordPress installation running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Authorization bypass in the Eventin WordPress plugin (versions 4.0.26-4.1.15) enables unauthenticated attackers to mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash to the payment_complete() REST endpoint. The wp_rest nonce required to reach this endpoint is embedded in the HTML of every public event page, eliminating any credential or session requirement. This is a confirmed regression - the same function and endpoint were previously patched by Arraytics, but the fix was lost in subsequent releases; no public exploit has been identified at time of analysis.
Stored cross-site scripting in the Eventin WordPress event management plugin (all versions through 4.1.15) lets any contributor-level user permanently embed malicious JavaScript in event FAQ sections via the unescaped `etn_faq_content` parameter. The CVSS scope change (S:C) confirms the impact crosses the attacker's security context - injected scripts execute in any visitor's browser who loads the affected event page, enabling session hijacking or credential harvesting of higher-privileged users including site administrators. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the low attack complexity and commonly granted contributor role make this a credible insider-threat risk on multi-user WordPress installations.
Authorization bypass in the WPCafe WordPress plugin (all versions through 3.0.14) allows any authenticated subscriber-level user to fully manage email notification flow workflows that are intended to be administrator-only. The FlowAPI REST endpoints bundled within the plugin's email notification SDK rely solely on a wp_rest nonce for access control - a token freely obtainable from the frontend page source by any logged-in user - completely bypassing role-based authorization. No public exploit or active exploitation has been identified at time of analysis, though the low exploitation complexity makes this a realistic risk on sites with open user registration.
Broken access control in the Arraytics WP Event Solution WordPress plugin through version 4.1.12 allows remote unauthenticated attackers to access protected functionality or data without authorization. The flaw stems from missing authorization checks (CWE-862) on plugin endpoints, exposing sensitive event-management capabilities or data to anyone who can reach the WordPress site. No public exploit identified at time of analysis, and the issue is not currently listed in the CISA KEV catalog.
Eventin - Events Calendar, Event Booking, Ticket & Registration plugin for WordPress fails to properly validate user capabilities in the get_item_permissions_check() function, allowing authenticated Subscriber-level users to enumerate and read arbitrary order data including customer names, emails, and phone numbers through order ID iteration. Affected versions include all releases up to and including 4.1.8. This is a low-complexity, network-accessible vulnerability (CVSS 4.3) that requires only basic authentication, making it exploitable by any user with a WordPress account on an affected site.
Missing authorization in Arraytics Booktics WordPress plugin through version 1.0.16 allows unauthenticated remote attackers to modify application data via incorrectly configured access control security levels. The vulnerability has a low EPSS score (0.02%, percentile 4) despite the network-accessible attack vector, suggesting limited real-world exploitation likelihood. No public exploit code or active CISA KEV status has been identified.
Missing Authorization vulnerability in Arraytics Timetics allows Accessing Functionality Not Properly Constrained by ACLs.0.23. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.