Description

The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-12T06:17:19.757Z",
  "pubdate": "2026-08-12T06:17:19.757Z",
  "executiveSummary": "An unauthenticated privilege-related security vulnerability has been identified in the Eventin WordPress plugin prior to version 4.1.20.\nThe flaw stems from a complete lack of access control enforcement within the plugin's waiting-list registration handler.\nThis architectural oversight allows remote, unauthenticated threat actors to interact directly with the vulnerable backend endpoint, resulting in unauthorized user account creation for arbitrary email addresses and the injection of unauthorized order records into the database.\nThe risk implications are severe, as unauthorized account provisioning can lead to privilege escalation, data poisoning, and unauthorized access to restricted application functionality.\nExploitation of this vulnerability requires network access to the target WordPress instance, but does not necessitate any prior authentication or special privileges.\nThe primary impact is the compromise of user data integrity and authentication controls through the unauthorized generation of accounts and transactional artifacts.",
  "technicalDetails": "The vulnerability resides within the waiting-list registration handler component of the Eventin WordPress plugin, specifically affecting all versions prior to 4.1.20.\nThe root cause of the security defect is the failure of the application logic to perform proper authorization checks and capability verifications before processing incoming requests to the waiting-list registration functionality.\nBecause the endpoint exposes backend registration functionality over the network without validating the session state or identity of the requester, it operates under an insecure direct object reference or missing function-level access control paradigm.\nThe attack flow proceeds as follows: First, an unauthenticated attacker crafts an HTTP request targeting the vulnerable waiting-list registration handler endpoint exposed by the Eventin plugin.\nSecond, the attacker supplies arbitrary target email addresses within the parameters of the request payload.\nThird, the plugin processes the input without validating permissions, subsequently instantiating new WordPress user accounts corresponding to the supplied arbitrary email addresses.\nConcurrently, the backend logic injects associated order records into the database as part of the anomalous waiting-list workflow.\nNetwork exposure is inherent to any publicly accessible WordPress installation utilizing the vulnerable plugin, as the handler is reachable via standard HTTP/HTTPS protocols without pre-requisite authentication tokens, cookies, or cryptographic nonces.\nPost-exploitation impact includes the mass generation of rogue user accounts, potential manipulation of e-commerce order workflows, data pollution within the WordPress user database, and potential cascading security failures if the newly created accounts can be leveraged for password reset attacks or subsequent authentication bypasses."
}