Description

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-12T06:17:15.223Z",
  "pubdate": "2026-08-12T06:17:15.223Z",
  "executiveSummary": "The Eventin WordPress plugin before 4.1.20 suffers from an improper access restriction vulnerability affecting stored customer records. This security flaw enables authenticated remote threat actors possessing contributor-level privileges or higher to improperly access, read, and exfiltrate sensitive personal identifiable information belonging to other customers, including full names and email addresses.\nThe root cause stems from insufficient authorization checks within the data retrieval routines of the affected product, failing to enforce proper capability validation before returning confidential customer data to the user session. The risk implication is moderate to high, as it compromises user privacy and data confidentiality by bypassing intended role-based access control boundaries within the WordPress environment.\nExploitation requires authenticated access to the WordPress application with at least contributor-level privileges, meaning an attacker must first obtain or provision a low-privileged account on the target system. No complex social engineering or specialized physical access is required beyond standard web application interaction, allowing unauthorized information disclosure directly through the vulnerable application interface.",
  "technicalDetails": "The Eventin WordPress plugin prior to version 4.1.20 implements insecure direct object reference or missing function-level access control patterns in its customer data management endpoints. Specifically, the vulnerable component responsible for querying and rendering stored customer records fails to adequately verify whether the requesting user possesses administrative or shop manager capabilities.\nThe root cause is rooted in inadequate authorization validation logic. While the application may restrict access to high-level administrative menus in the user interface, the underlying AJAX handlers, REST API endpoints, or PHP backend functions processing requests for customer lists do not sufficiently validate the current user's role against the required capability set before executing database queries to retrieve personal data.\nThe attack flow proceeds as follows: First, an authenticated attacker with contributor-level privileges authenticates to the target WordPress instance. Second, the attacker interacts directly with the vulnerable backend endpoint or parameter responsible for fetching customer records. Because the access control check is absent or improperly configured, the application processes the request without validating authorization.\nThird, the database executes the query and returns the sensitive records containing customer names and email addresses to the application context. Finally, the response is serialized and returned to the attacker, resulting in the unauthorized disclosure of personally identifiable information. The privilege requirement is restricted to contributor-level access and above, and the attack surface is exposed over standard HTTP/HTTPS protocols via the WordPress application interface. Post-exploitation impact is limited to information disclosure, specifically the harvesting of customer credentials, communication vectors, or personal identities for secondary attacks such as phishing or credential stuffing campaigns."
}