Description

The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-19T06:17:32.200Z",
  "pubdate": "2026-08-19T06:17:32.200Z",
  "executiveSummary": "An access control vulnerability exists within the Eventin WordPress plugin prior to version 4.1.21, specifically stemming from a failure to properly enforce authorization checks during account deletion operations.\nThe vulnerability allows authenticated remote threat actors possessing contributor-level privileges or higher to execute unauthorized account terminations against arbitrary users within the WordPress environment.\nThe primary impact of this flaw is the potential for mass disruption, data loss, and unauthorized privilege escalation or system sabotage through the malicious deletion of administrative and high-privileged accounts.\nRisk implications are severe as successful exploitation compromises the integrity and availability of the affected WordPress instance, potentially leading to complete denial of service or administrative lockout.\nAttackers require low-privilege authentication, specifically a valid user account with contributor capabilities, to interact with the vulnerable endpoint and trigger the deletion routine.\nNo complex exploitation vectors are required, as the vulnerability resides entirely within the application logic's failure to validate object ownership and user roles before processing state-changing requests.",
  "technicalDetails": "The root cause of the vulnerability lies in broken object-level authorization and insufficient capability checks within the backend administrative logic handling user account management functions in the Eventin plugin.\nSpecifically, the vulnerable component fails to verify whether the requesting user session possesses the requisite administrative capabilities, nor does it validate whether the requesting entity owns or has legitimate administrative jurisdiction over the target user account identifier being supplied in the request.\nAttackers with contributor-level access can craft malicious HTTP requests directed at the vulnerable functional endpoint responsible for account deletion.\nThe attack flow proceeds as follows: 1) The authenticated low-privileged user identifies the target user ID to be deleted. 2) The user transmits a crafted request to the Eventin backend deletion handler. 3) The application accepts the request without validating authorization parameters, object ownership, or current user roles. 4) The backend executes the database query or API call to permanently delete the specified user account.\nAffected versions include all configurations of the Eventin WordPress plugin prior to version 4.1.21.\nAuthentication is required in the form of a low-privileged contributor account, and the attack vector is network-based via standard HTTP/HTTPS requests interacting with the WordPress REST API or admin-ajax endpoints managed by the plugin.\nPost-exploitation impact includes permanent data loss associated with deleted user profiles, disruption of site operations, and potential removal of legitimate site administrators, paving the way for complete system takeover if administrative accounts are purged."
}