Description

The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-19T06:17:32.480Z",
  "pubdate": "2026-08-19T06:17:32.480Z",
  "executiveSummary": "An Insecure Direct Object Reference (IDOR) vulnerability exists in the Eventin WordPress plugin prior to version 4.1.21, specifically within the schedule records management functionality. The root cause stems from a lack of proper authorization checks and ownership verification, failing to validate whether the authenticated user modifying or deleting a schedule entry is the original creator or possesses adequate administrative privileges. An authenticated malicious actor with contributor-level access or higher can exploit this flaw to manipulate, alter, or permanently delete arbitrary schedule records created by other users within the WordPress environment. The business impact includes data integrity compromise, unauthorized content destruction, and potential operational disruption of events managed through the affected platform. Exploitation requires authenticated access at the contributor role tier and relies on manipulating identifiers associated with schedule entries. No complex payloads or unauthenticated vectors are required, making this an accessible vector for internal privilege escalation or malicious tampering by low-privileged users.",
  "technicalDetails": "The vulnerability resides in the Eventin WordPress plugin affecting versions prior to 4.1.21, specifically within the backend logic handling schedule record modification and deletion requests. The root cause of the security defect is an absence of adequate access control checks and object-level authorization validation. When a user issues a request to update or delete a schedule entry, the application processes the action based solely on the supplied record identifier without cross-referencing the requesting user's identity or capabilities against the ownership metadata of the target object.\nThe attack flow proceeds as follows: 1. An attacker authenticates to the target WordPress installation with a low-privileged account holding contributor-level access. 2. The attacker identifies or enumerates the unique identifiers (IDs) of schedule records created by other users, such as administrators or event organizers. 3. The attacker crafts an HTTP request targeting the schedule modification or deletion endpoint, supplying the arbitrary record ID belonging to a victim user. 4. The vulnerable backend component processes the incoming request, trusting the client-supplied identifier implicitly. 5. Due to the lack of ownership verification, the application executes the state-changing operation, successfully altering or deleting the victim's schedule entry.\nThe vulnerable component involves the backend functions responsible for handling schedule CRUD (Create, Read, Update, Delete) operations within the plugin architecture. Because contributor-level users are permitted to create specific types of content, the application implicitly trusts their ability to manage records, failing to isolate entries by author ID or role boundaries. The attack surface is exposed via standard WordPress AJAX or REST API endpoints routed through the plugin. Post-exploitation impact encompasses unauthorized data destruction, defacement of event schedules, and disruption of event management workflows, severely undermining the integrity of the application's data layer."
}