Eventin
Monthly
Unauthenticated account creation in the Eventin WordPress plugin (all versions before 4.1.20) allows any remote attacker to register arbitrary email addresses as WordPress user accounts and inject order records by exploiting a missing authorization check on the waiting-list registration handler. The dual impact - rogue account creation and order record injection - can be chained with WordPress's built-in password reset flow to achieve full account takeover for any email address on the system. With a publicly available exploit and a 15% EPSS score placing this well above the median exploitation probability, this represents an elevated and realistic risk for all WordPress sites running the unpatched plugin; no CISA KEV listing is confirmed at time of analysis.
Local file inclusion in the Eventin WordPress plugin (all versions before 4.1.20) allows authenticated users holding editor-level or higher WordPress roles to supply an arbitrary local filesystem path as a template setting, causing the plugin to include and execute any reachable PHP file on the server. Full confidentiality, integrity, and availability impact is achievable on a successful exploitation. A publicly available proof-of-concept from WPScan exists, though the CVE carries no CISA KEV listing and an EPSS of only 0.16%, indicating no confirmed widespread active exploitation campaigns at time of analysis.
Broken authorization in the Eventin WordPress plugin before 4.1.16 lets unauthenticated visitors create orders and supply their own order status, marking those orders as paid without ever completing payment. Because the order-creation endpoint neither authorizes the requester nor validates the payment state, remote attackers can forge fully-paid transactions, undermining ticket/event revenue integrity. Publicly available exploit code exists (reported by WPScan), though EPSS remains low at 0.15% and it is not listed in CISA KEV.
Unauthenticated visitors can mark unpaid Eventin orders of any value as paid by replaying a single genuine low-value payment transaction, because the plugin only checks that the gateway reports success and never validates the amount, currency, or which order the transaction belongs to. The flaw affects WordPress sites running the Eventin event-management plugin before version 4.1.24, and exploit detail is publicly available via the WPScan advisory. There is no indication in the supplied data that this is being actively exploited (no CISA KEV listing), and EPSS data was not provided.
Unauthenticated attackers can reset any existing order and its attendees to a pending state in the Eventin WordPress plugin before 4.1.24, invalidating already-paid tickets, when the plugin's offline (local) payment method is enabled. The finalisation routine relies on a nonce that the plugin exposes to unauthenticated visitors and never verifies that the caller owns the targeted order, making this a missing-authorization flaw rather than an authentication one. Exploitation is gated by configuration: the site must have the offline payment method active and at least one existing order to target, and publicly available exploit code exists, but there is no evidence of confirmed active exploitation (CISA KEV) and the EPSS score is very low at 0.18% (8th percentile). Impact is limited to integrity - order/attendee state is corrupted, with no data disclosure or service outage - so this is a genuine but low-priority issue. Fixed in Eventin 4.1.24.
Broken access control in the Eventin WordPress plugin before 4.1.24 lets an authenticated contributor (or any higher role) create brand-new WordPress user accounts through the plugin's add-speaker functionality, and by supplying an email address they control, convert that into a working login to an account holding capabilities greater than their own - notably publishing content and uploading files. The flaw is a missing-authorization issue (CWE-862), so valid low-privilege credentials are a prerequisite; the tag 'Authentication Bypass' overstates it, and the privilege gained is author-level rather than full site takeover. The vendor has released a fix (4.1.24) and publicly available exploit code exists, while the EPSS score remains low at 0.17% (7th percentile), consistent with a bounded-impact, authenticated attack surface.
Missing authorization in the Eventin WordPress plugin before 4.1.24 allows unauthenticated attackers to reuse the order-scoped token that the plugin itself issues during guest checkout to swap a paid ticket for a free one and then complete the order at no cost. The flaw is a business-logic/fraud issue rather than a site-compromise vector: it yields no data disclosure, no privilege escalation and no denial of service, and it only affects sites running Eventin with paid ticketing and guest checkout enabled, and only on the attacker's own order. Publicly available exploit code exists, and the vendor has released a fix in 4.1.24; EPSS is low (0.18%, 8th percentile), consistent with a narrowly targeted revenue-loss bug rather than a mass-exploited one.
Missing authorization on Eventin's event-management REST routes allows low-privilege WordPress contributors to perform integrity-impacting actions outside their permitted scope. Affected installations running Eventin before 4.1.22 expose endpoints that let contributor-role users redirect the site's public front page to an arbitrary event they do not own, and create, edit, or delete global event and speaker taxonomy terms site-wide. A publicly available exploit is documented by WPScan, though SSVC exploitation status is none and EPSS is 0.13%, indicating no confirmed active abuse at time of analysis.
Local file inclusion in Eventin WordPress plugin before 4.1.21 enables authenticated contributors and higher-privileged users to include and execute arbitrary PHP files on the web server. The plugin fails to validate a user-supplied template path parameter before passing it to a PHP file-inclusion routine, allowing path traversal to any locally accessible PHP file. A publicly available proof-of-concept has been published by WPScan; vendor patch 4.1.21 is available and should be applied immediately.
Unauthenticated payment bypass in the Eventin WordPress plugin before 4.1.19 lets any visitor fraudulently obtain valid paid event tickets without completing payment. By abusing a guest checkout token, an attacker can transition their own unpaid order to 'completed', triggering ticket issuance without a charge being processed. A publicly available proof-of-concept exists, and SSVC flags the attack as automatable - enabling scaled ticket fraud against any WordPress site running the affected plugin.
Unauthenticated information disclosure in the Eventin WordPress plugin before 4.1.22 exposes private, draft, and pending posts - including the plaintext passwords and full content of password-protected posts - to any unauthenticated HTTP client via an unprotected REST API namespace. The flaw arises from missing authorization checks on post status and ownership within that namespace, meaning no credentials or privileges are required to enumerate and read content the site owner intended to restrict. A publicly available proof-of-concept exploit exists, and the attack is fully automatable per the SSVC framework, though CISA has not listed this in KEV and the EPSS score is low (0.18%), suggesting exploitation has not yet been widespread.
Blind server-side request forgery in the Eventin WordPress plugin prior to version 4.1.21 allows contributor-level authenticated users to direct the WordPress server to issue arbitrary outbound HTTP requests by supplying unvalidated webhook URLs on events they do not own. Two distinct control failures compound the issue: webhook URL input is accepted without sanitization, and the plugin performs no event ownership check, meaning any contributor can abuse another user's event configuration. A publicly available proof-of-concept exists; no CISA KEV listing confirms active exploitation at time of analysis.
Eventin WordPress plugin versions from 4.1.9 through 4.1.19 exposes customer order records - including personal information - to any contributor-level or higher WordPress user via an Insecure Direct Object Reference (IDOR) flaw. Authenticated users can enumerate order identifiers sequentially to read arbitrary customers' purchase data without authorization. A public proof-of-concept is available via WPScan, and an EPSS score of 14% places this notably above the median for WordPress plugin vulnerabilities, indicating active interest from threat actors even without a CISA KEV listing.
Eventin WordPress plugin versions before 4.1.20 exposes stored customer records - including names and email addresses - to any authenticated WordPress user holding contributor-level access or higher, due to missing server-side capability checks on customer data retrieval. A publicly available proof-of-concept exploit exists per the WPScan advisory, and an EPSS score of 15% places exploitation probability well above the median for medium-severity CVEs. The vendor-released patch (version 4.1.20) resolves the access control gap; no active exploitation is confirmed in the CISA KEV catalog at time of analysis.
The Eventin plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.34. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Reflected cross-site scripting in the Eventin WordPress plugin up to version 4.0.28 allows unauthenticated attackers to inject arbitrary web scripts via crafted URLs. When a victim clicks the link while authenticated, the malicious code executes in their browser, potentially leading to session hijacking or site defacement. At the time of analysis, no public exploit or active exploitation has been identified, and the EPSS score of 0.04% indicates very low exploitation probability.
Incorrect Privilege Assignment vulnerability in Themewinter Eventin allows Privilege Escalation.0.26. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 28.9% and no vendor patch available.
Relative Path Traversal vulnerability in Themewinter Eventin allows Path Traversal.0.26. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 4.0.26 via the proxy_image(). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themewinter Eventin allows PHP Local File Inclusion.0.25. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.24 via the 'style' parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themewinter Eventin allows PHP Local File Inclusion.0.20. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
Path Traversal: '.../...//' vulnerability in Arraytics Eventin wp-event-solution allows Path Traversal.0.7. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Arraytics Eventin wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.3.52. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.8 via multiple style. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themewinter Eventin allows Stored XSS.0.5. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themewinter Eventin allows Stored XSS.3.57. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to unauthorized data importation due to a missing capability check on the 'import_file'. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Event Manager, Events Calendar, Events Tickets for WooCommerce - Eventin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_data(). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Unauthenticated account creation in the Eventin WordPress plugin (all versions before 4.1.20) allows any remote attacker to register arbitrary email addresses as WordPress user accounts and inject order records by exploiting a missing authorization check on the waiting-list registration handler. The dual impact - rogue account creation and order record injection - can be chained with WordPress's built-in password reset flow to achieve full account takeover for any email address on the system. With a publicly available exploit and a 15% EPSS score placing this well above the median exploitation probability, this represents an elevated and realistic risk for all WordPress sites running the unpatched plugin; no CISA KEV listing is confirmed at time of analysis.
Local file inclusion in the Eventin WordPress plugin (all versions before 4.1.20) allows authenticated users holding editor-level or higher WordPress roles to supply an arbitrary local filesystem path as a template setting, causing the plugin to include and execute any reachable PHP file on the server. Full confidentiality, integrity, and availability impact is achievable on a successful exploitation. A publicly available proof-of-concept from WPScan exists, though the CVE carries no CISA KEV listing and an EPSS of only 0.16%, indicating no confirmed widespread active exploitation campaigns at time of analysis.
Broken authorization in the Eventin WordPress plugin before 4.1.16 lets unauthenticated visitors create orders and supply their own order status, marking those orders as paid without ever completing payment. Because the order-creation endpoint neither authorizes the requester nor validates the payment state, remote attackers can forge fully-paid transactions, undermining ticket/event revenue integrity. Publicly available exploit code exists (reported by WPScan), though EPSS remains low at 0.15% and it is not listed in CISA KEV.
Unauthenticated visitors can mark unpaid Eventin orders of any value as paid by replaying a single genuine low-value payment transaction, because the plugin only checks that the gateway reports success and never validates the amount, currency, or which order the transaction belongs to. The flaw affects WordPress sites running the Eventin event-management plugin before version 4.1.24, and exploit detail is publicly available via the WPScan advisory. There is no indication in the supplied data that this is being actively exploited (no CISA KEV listing), and EPSS data was not provided.
Unauthenticated attackers can reset any existing order and its attendees to a pending state in the Eventin WordPress plugin before 4.1.24, invalidating already-paid tickets, when the plugin's offline (local) payment method is enabled. The finalisation routine relies on a nonce that the plugin exposes to unauthenticated visitors and never verifies that the caller owns the targeted order, making this a missing-authorization flaw rather than an authentication one. Exploitation is gated by configuration: the site must have the offline payment method active and at least one existing order to target, and publicly available exploit code exists, but there is no evidence of confirmed active exploitation (CISA KEV) and the EPSS score is very low at 0.18% (8th percentile). Impact is limited to integrity - order/attendee state is corrupted, with no data disclosure or service outage - so this is a genuine but low-priority issue. Fixed in Eventin 4.1.24.
Broken access control in the Eventin WordPress plugin before 4.1.24 lets an authenticated contributor (or any higher role) create brand-new WordPress user accounts through the plugin's add-speaker functionality, and by supplying an email address they control, convert that into a working login to an account holding capabilities greater than their own - notably publishing content and uploading files. The flaw is a missing-authorization issue (CWE-862), so valid low-privilege credentials are a prerequisite; the tag 'Authentication Bypass' overstates it, and the privilege gained is author-level rather than full site takeover. The vendor has released a fix (4.1.24) and publicly available exploit code exists, while the EPSS score remains low at 0.17% (7th percentile), consistent with a bounded-impact, authenticated attack surface.
Missing authorization in the Eventin WordPress plugin before 4.1.24 allows unauthenticated attackers to reuse the order-scoped token that the plugin itself issues during guest checkout to swap a paid ticket for a free one and then complete the order at no cost. The flaw is a business-logic/fraud issue rather than a site-compromise vector: it yields no data disclosure, no privilege escalation and no denial of service, and it only affects sites running Eventin with paid ticketing and guest checkout enabled, and only on the attacker's own order. Publicly available exploit code exists, and the vendor has released a fix in 4.1.24; EPSS is low (0.18%, 8th percentile), consistent with a narrowly targeted revenue-loss bug rather than a mass-exploited one.
Missing authorization on Eventin's event-management REST routes allows low-privilege WordPress contributors to perform integrity-impacting actions outside their permitted scope. Affected installations running Eventin before 4.1.22 expose endpoints that let contributor-role users redirect the site's public front page to an arbitrary event they do not own, and create, edit, or delete global event and speaker taxonomy terms site-wide. A publicly available exploit is documented by WPScan, though SSVC exploitation status is none and EPSS is 0.13%, indicating no confirmed active abuse at time of analysis.
Local file inclusion in Eventin WordPress plugin before 4.1.21 enables authenticated contributors and higher-privileged users to include and execute arbitrary PHP files on the web server. The plugin fails to validate a user-supplied template path parameter before passing it to a PHP file-inclusion routine, allowing path traversal to any locally accessible PHP file. A publicly available proof-of-concept has been published by WPScan; vendor patch 4.1.21 is available and should be applied immediately.
Unauthenticated payment bypass in the Eventin WordPress plugin before 4.1.19 lets any visitor fraudulently obtain valid paid event tickets without completing payment. By abusing a guest checkout token, an attacker can transition their own unpaid order to 'completed', triggering ticket issuance without a charge being processed. A publicly available proof-of-concept exists, and SSVC flags the attack as automatable - enabling scaled ticket fraud against any WordPress site running the affected plugin.
Unauthenticated information disclosure in the Eventin WordPress plugin before 4.1.22 exposes private, draft, and pending posts - including the plaintext passwords and full content of password-protected posts - to any unauthenticated HTTP client via an unprotected REST API namespace. The flaw arises from missing authorization checks on post status and ownership within that namespace, meaning no credentials or privileges are required to enumerate and read content the site owner intended to restrict. A publicly available proof-of-concept exploit exists, and the attack is fully automatable per the SSVC framework, though CISA has not listed this in KEV and the EPSS score is low (0.18%), suggesting exploitation has not yet been widespread.
Blind server-side request forgery in the Eventin WordPress plugin prior to version 4.1.21 allows contributor-level authenticated users to direct the WordPress server to issue arbitrary outbound HTTP requests by supplying unvalidated webhook URLs on events they do not own. Two distinct control failures compound the issue: webhook URL input is accepted without sanitization, and the plugin performs no event ownership check, meaning any contributor can abuse another user's event configuration. A publicly available proof-of-concept exists; no CISA KEV listing confirms active exploitation at time of analysis.
Eventin WordPress plugin versions from 4.1.9 through 4.1.19 exposes customer order records - including personal information - to any contributor-level or higher WordPress user via an Insecure Direct Object Reference (IDOR) flaw. Authenticated users can enumerate order identifiers sequentially to read arbitrary customers' purchase data without authorization. A public proof-of-concept is available via WPScan, and an EPSS score of 14% places this notably above the median for WordPress plugin vulnerabilities, indicating active interest from threat actors even without a CISA KEV listing.
Eventin WordPress plugin versions before 4.1.20 exposes stored customer records - including names and email addresses - to any authenticated WordPress user holding contributor-level access or higher, due to missing server-side capability checks on customer data retrieval. A publicly available proof-of-concept exploit exists per the WPScan advisory, and an EPSS score of 15% places exploitation probability well above the median for medium-severity CVEs. The vendor-released patch (version 4.1.20) resolves the access control gap; no active exploitation is confirmed in the CISA KEV catalog at time of analysis.
The Eventin plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.34. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Reflected cross-site scripting in the Eventin WordPress plugin up to version 4.0.28 allows unauthenticated attackers to inject arbitrary web scripts via crafted URLs. When a victim clicks the link while authenticated, the malicious code executes in their browser, potentially leading to session hijacking or site defacement. At the time of analysis, no public exploit or active exploitation has been identified, and the EPSS score of 0.04% indicates very low exploitation probability.
Incorrect Privilege Assignment vulnerability in Themewinter Eventin allows Privilege Escalation.0.26. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 28.9% and no vendor patch available.
Relative Path Traversal vulnerability in Themewinter Eventin allows Path Traversal.0.26. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 4.0.26 via the proxy_image(). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themewinter Eventin allows PHP Local File Inclusion.0.25. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.24 via the 'style' parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themewinter Eventin allows PHP Local File Inclusion.0.20. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
Path Traversal: '.../...//' vulnerability in Arraytics Eventin wp-event-solution allows Path Traversal.0.7. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Arraytics Eventin wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.3.52. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.8 via multiple style. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themewinter Eventin allows Stored XSS.0.5. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themewinter Eventin allows Stored XSS.3.57. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to unauthorized data importation due to a missing capability check on the 'import_file'. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Event Manager, Events Calendar, Events Tickets for WooCommerce - Eventin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_data(). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.