Description

The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces, allowing unauthenticated users to retrieve draft, pending and private posts belonging to other users, along with the passwords and contents of password-protected ones.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-26T06:16:23.350Z",
  "pubdate": "2026-08-26T06:16:23.350Z",
  "executiveSummary": "The Eventin WordPress plugin prior to version 4.1.22 contains an Improper Access Control vulnerability within its REST API implementation. This flaw allows unauthenticated remote attackers to bypass authorization checks and access non-public post content.\nBy targeting specific API endpoints, an attacker can retrieve drafts, pending reviews, and private posts, as well as extract content and passwords from password-protected posts. This unauthorized data exposure poses a significant risk to the confidentiality of sensitive site data, potentially exposing unpublished content, internal planning materials, or confidential communications. The vulnerability does not require authentication, making it trivial to exploit over a network against any WordPress installation running an affected version of the Eventin plugin.",
  "technicalDetails": "The vulnerability resides within the REST API namespace registered by the Eventin plugin. The core issue is an insufficient validation of access permissions when processing API requests that query post resources. In a secure implementation, the WordPress REST API infrastructure must check the 'read' capability for the specific post object requested. However, in the vulnerable Eventin implementation, the API endpoint fails to verify if the requesting user has the appropriate privileges to view content that has not been explicitly marked as 'publish'.\nThe attack flow begins when an unauthenticated attacker sends a GET request to the vulnerable Eventin-defined REST API endpoint. Because the plugin does not enforce proper status-based or ownership-based access control, the underlying query parameters or endpoint logic allow the application to bypass standard WordPress visibility filters. When the REST API processes these requests, it inadvertently retrieves post objects regardless of their 'post_status'—such as 'draft', 'pending', or 'private'. Furthermore, for posts configured with password protection, the endpoint fails to enforce the requirement for the correct password to be provided, exposing the raw content and the password field itself to the attacker.\nThis behavior facilitates mass data harvesting. An attacker can iterate through post IDs or utilize API filtering parameters to extract sensitive, non-public information from the site's database. Because the vulnerability is exposed via the public REST API, there is no requirement for a registered user account or elevated administrative privileges. The lack of authorization logic within the specific Eventin controller means that the plugin effectively promotes private and protected data to public visibility. The impact of this post-exploitation scenario includes the loss of intellectual property, exposure of sensitive internal communications, and potential leakage of user-generated content that was never intended for public consumption. Given the broad nature of the REST API exposure, an attacker can automate the retrieval process, leading to a complete compromise of site content confidentiality without leaving significant traces in typical application-level access logs."
}