CVE-2026-75983
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
The Eventin plugin for WordPress up to version 4.1.23 is vulnerable to privilege escalation. The PermissionManager::manage_permissions() function is registered as a callback on WordPress core's map_meta_cap filter and unconditionally returns the always-true 'exist' primitive for every capability check whenever the evaluated user ID is 1, without scoping to plugin-specific capabilities. This allows authenticated attackers with user ID 1, even subscribers, to pass every WordPress capability check, including manage_options, edit_plugins, edit_themes, promote_users, and update_core, leading to full site takeover and remote code execution. Exploitation is only impactful when user ID 1 has been deliberately demoted to a lower-privilege role; on default installations where user ID 1 retains the administrator role, no incremental privilege gain occurs.
Risk Assessment
Risk of full WordPress site takeover, including remote code execution, if the account with ID 1 has been demoted. This can lead to data confidentiality and integrity breaches and loss of control over the site.
Recommendation
Update the Eventin plugin to the latest version that includes a fix. If possible, restore user ID 1 to the administrator role or change the admin account ID to avoid privilege escalation.
Other vulnerabilities in Eventin WordPress plugin
See all- CVE-2026-84906Medium
The Eventin WordPress plugin before version 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the payment gateway reports the transaction as successful, not its amount, currency, or which order it belongs to, allowing unauthenticated visitors to mark unpaid orders of any value as paid by replaying the transaction of a single genuine low-value payment.
- CVE-2026-15402Medium
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'etn_shedule_objective' schedule_slot parameter in all versions up to and including 4.1.23 due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or above can inject arbitrary web scripts into pages that execute when a user accesses the injected page.
- CVE-2026-13175Medium
The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users.
- CVE-2026-13174High
The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts.
- CVE-2026-13173Low
The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creation, allowing users with contributor-level access and above to modify other users' roles and metadata.
- CVE-2026-13169High
The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including administrators.
- CVE-2026-13170High
The Eventin WordPress plugin before version 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with editor-level access and above to include and execute arbitrary local PHP files.
Original NVD description (English source)
The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.1.23. This is due to the `PermissionManager::manage_permissions()` function being registered as a callback on WordPress core's `map_meta_cap` filter and unconditionally returning the always-true `'exist'` primitive for every capability check whenever the evaluated user ID is 1, without scoping this behavior to plugin-specific capabilities. This makes it possible for authenticated attackers whose account is user ID 1, even subscribers, to pass every WordPress capability check, including `manage_options`, `edit_plugins`, `edit_themes`, `promote_users`, and `update_core`, thereby elevating their privileges to administrator-equivalent power and achieving full site takeover, including remote code execution via the plugin and theme editors. Exploitation is only impactful when user ID 1 has been deliberately demoted to a lower-privilege role as a common administrator-account hardening practice; on default installations where user ID 1 retains the administrator role, no incremental privilege gain occurs.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS