Description

The Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.1.29 via the 'id' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the email address and phone number of any WordPress user, including administrators, by supplying their user id in a query-string parameter while placing the authenticated user's own id in the URL path.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-11-06T10:16:35.767Z",
  "pubdate": "2026-11-06T10:16:35.767Z",
  "executiveSummary": "The Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress contains a sensitive information exposure vulnerability affecting all versions up to and including 4.1.29.\nThis vulnerability stems from insufficient input validation and authorization checks, allowing authenticated users with subscriber-level privileges or higher to access restricted PII (Personally Identifiable Information).\nAn attacker can exploit this flaw to harvest the email addresses and phone numbers of arbitrary WordPress users, including highly privileged accounts such as administrators.\nThe vulnerability requires an active, authenticated session with at least a subscriber-level account, posing a significant risk to user privacy and providing an attacker with valuable intelligence for follow-up activities like targeted social engineering or account takeover attempts.\nThere is no indication of remote, unauthenticated exploitability; however, the reliance on standard subscriber access makes this a low-barrier attack for any registered user on the target system.",
  "technicalDetails": "The vulnerability exists due to improper server-side authorization controls within the Eventin plugin's data retrieval mechanisms. Specifically, the application fails to validate whether the authenticated user requesting data has the appropriate permissions to view the user profile information associated with a requested user ID.\nThe attack vector involves a query-string manipulation targeting the 'id' parameter. When a request is made, the application incorrectly trusts the user-supplied 'id' parameter in the query string to determine which user's profile information should be returned, rather than enforcing ownership or administrative capability checks.\nThe attack flow proceeds as follows: 1) The attacker authenticates to the WordPress instance with at least subscriber-level privileges. 2) The attacker constructs a request that includes their own valid user ID within the URL path, effectively bypassing basic routing or session-bound checks that might otherwise look at the path alone. 3) The attacker injects the target user's ID into the 'id' query parameter. 4) The server processes this request and, failing to perform an access control check against the target ID, returns a JSON or HTML response containing the target user's sensitive PII, specifically email addresses and phone numbers.\nThis flaw resides in the handling of user-controllable input for data retrieval functions. By failing to verify if the 'id' requested in the query string matches the session's authenticated identity or an authorized administrative context, the plugin creates an Insecure Direct Object Reference (IDOR) pattern that leads to the unintended disclosure of user metadata.\nBecause WordPress stores core profile fields (like email and phone number) in the wp_users and associated metadata tables, this exposure grants the attacker full contact information for any user within the database. This represents a critical failure in the plugin’s security architecture regarding the 'principle of least privilege', as it permits a low-privileged subscriber to query administrative metadata that should be restricted.\nPost-exploitation, the gathered information can be leveraged for further attacks, including spear-phishing campaigns, credential stuffing, or other reconnaissance activities targeting privileged users whose administrative status is revealed through this data leak."
}