Description

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-19T06:17:31.677Z",
  "pubdate": "2026-08-19T06:17:31.677Z",
  "executiveSummary": "An Insecure Direct Object Reference (IDOR) and broken access control vulnerability exists in the Eventin WordPress plugin prior to version 4.1.21. The vulnerability stems from a failure to adequately verify the ownership of event objects during modification, deletion, and reassignment operations.\nThis security flaw allows authenticated remote attackers with contributor-level privileges or higher to manipulate, remove, or hijack events generated by other users, including high-privileged accounts such as administrators.\nThe risk implications are significant as unauthorized users can disrupt calendar management, alter event details maliciously, or assume administrative ownership of critical organization events.\nExploitation requires authenticated access at the contributor level or above, but does not necessitate complex interaction or advanced attacker capabilities beyond crafting valid state-changing requests directed at the vulnerable component.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of proper authorization checks and object ownership validation within the Eventin plugin's event management logic. When processing requests to modify, delete, or reassign events, the application fails to verify whether the currently authenticated user session possesses ownership or administrative rights over the targeted event ID.\nThe vulnerable component consists of the backend request handlers responsible for processing event updates, deletions, and metadata reassignments within the Eventin plugin across affected versions prior to 4.1.21.\nAuthentication is required to exploit this vulnerability, specifically a minimum privilege level of a contributor within the WordPress installation. Network exposure is standard for web-based WordPress endpoints accessible via HTTP/HTTPS.\nThe attack flow proceeds as follows: First, an attacker with a contributor-level account identifies a target event ID created by another user or an administrator. Second, the attacker crafts an HTTP request targeting the event modification or reassignment functionality, substituting the event ID and specifying arbitrary changes or a new author ID. Third, because the application lacks proper access controls, it processes the request and executes the state change without verifying if the requesting user is the original author or holds administrative privileges.\nPost-exploitation impact includes unauthorized data tampering, denial of service through event deletion, and privilege escalation over specific resource ownership where an attacker can successfully reassign critical administrator-created events to their own low-privileged account."
}