Eventin

WP Event Solution: The CVSS vector permits an unauthenticated attacker. Attacker-controlled content is stored and later rendered without adequate neutralization, allowing script to execute in the affected site origin when a user views the output. The export does not identify the victim role, storage field or rendering function. The authoritative export does not name the vulnerable endpoint, request action, parameter or implementation function. Published affected versions: <= 4.1.26.

Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Event Solution: from n/a through 4.1.26. The CNA vector specifies an unauthenticated attacker and does not require victim interaction; the exact WordPress role is not identified for authenticated access. An insufficient authorization check exposes an operation or data beyond the caller's intended permissions. The export does not identify the vulnerable endpoint, action, parameter or function.

A request can reach a protected operation without its intended authorization check. The CNA vector requires no authentication and no victim interaction, with limited unauthorized changes to protected data. The export does not identify the endpoint, action, parameter, affected records or operation. A specific account-takeover, payment-manipulation or code-execution chain is not established. Affected versions: <= 4.1.25. The authoritative export identifies 4.1.26 as fixed for this CVE.

No attacker login is required. A caller can reach a protected operation without its intended permission check. The resource, operation and request fields are undisclosed. The supplied vector reports limited integrity impact, limited availability impact. The vector requires no victim interaction. Affected versions: <= 4.1.25. The authoritative export identifies 4.1.26 as fixed for this CVE.

No attacker login is required by the supplied CVSS vector. Information intended to remain protected is exposed to an unauthorized caller. The vector reports limited confidentiality impact without victim interaction. The export does not identify the response, data fields or information contents, so credential or personal-data exposure cannot be assumed. The authoritative export does not identify the vulnerable endpoint, action, parameter or function, so the exact request-to-operation path is undisclosed. Affected versions: <= 4.1.25. The authoritative export identifies 4.1.26 as fixed for this CVE.

No attacker login is required by the supplied CVSS vector. A caller can reach a protected operation without the intended permission check. The vector indicates limited unauthorized changes. No victim interaction is required by the vector. The protected resource and exact unauthorized operation are undisclosed. The authoritative export does not identify the vulnerable endpoint, action, parameter or function, so the exact request-to-operation path is undisclosed. Affected versions: <= 4.1.25. The authoritative export identifies 4.1.26 as fixed for this CVE.

Eventin before 4.1.24 checks that a gateway transaction succeeded but does not bind it to the order being marked paid or verify the amount and currency. An unauthenticated visitor who has made a genuine low-value payment can replay that transaction against unrelated unpaid orders of any value. The export does not name the payment gateway, callback, transaction field or order-selection parameter. A real successful payment is a prerequisite; this is not payment creation from nothing.

Eventin from 4.1.5 up to but not including 4.1.24: When offline/local payment is enabled, an unauthenticated requester can use a publicly exposed nonce to finalize an order without an ownership check. Targeting an existing order resets it and its attendees to pending, invalidating paid tickets. The export does not name the route, order-ID field or callback.

Eventin before 4.1.24: A Contributor or higher can add a speaker without the capability required to create WordPress users. The operation can create an account with permissions beyond the caller's own, including publishing and uploading; supplying an attacker-controlled email can produce a usable login. The export does not name the account-creation handler or fields, and does not establish administrator-role creation.

Eventin before 4.1.24: An unauthenticated guest can reuse the token issued during checkout to alter the order's tickets afterward. The token permits replacement of a paid ticket with a free one followed by completion at no charge. The export does not name the mutation endpoint, token field or finalization function.

Eventin through 4.1.23 registers PermissionManager::manage_permissions() on WordPress's map_meta_cap filter and returns the always-true exist primitive for every capability check when the evaluated user ID is 1. An attacker who can log in as user ID 1 therefore passes checks such as manage_options, promote_users, edit_plugins, edit_themes, and update_core even if that account was demoted to Subscriber. This enables administrator-equivalent site takeover and can permit code execution through plugin or theme editors where those editors are enabled. The condition is specific to a demoted user ID 1; there is no additional privilege gain when that account is already an administrator. No particular attack endpoint is required by the described global capability-filter flaw.

Eventin through 4.1.23 insufficiently sanitizes and escapes etn_shedule_objective in the schedule_slot data. An authenticated Contributor or higher can store attacker-controlled schedule content; rendering the affected page places that content into browser output and executes injected scripts for viewers. The export identifies the field and schedule context but does not disclose the request route, save action, exact handler function, or HTML escaping context.

Eventin through 4.1.22 fails to authorize booking-status changes. Although the advisory initially describes Subscriber access, its documented chain is unauthenticated: frontend pages expose a wp_rest nonce, and the order-creation endpoint returns an order_access_token to callers holding it. Together these reach the privileged update_booking_status branch, letting visitors mark unpaid orders completed, consume ticket inventory, and trigger confirmation emails without paying.

Eventin through 4.1.17 fails to check authorization for notification-flow automation workflows. A Subscriber or higher-privileged user can view, create, update, clone, and delete workflows intended to be managed only by administrators.

Eventin through 4.1.22 uses attacker-controlled event_layout values for local file inclusion. Contributors receive etn_manage_event by default and can set the value through the REST API without extra configuration. This allows inclusion and execution of existing PHP files, potentially exposing sensitive information or bypassing access controls. Executing newly supplied attacker code additionally requires a way to place a suitable PHP file on the server.

Eventin through 4.1.22 allows authenticated users with the custom-level access described by the advisory to supply event_layout values that include and execute existing server-side PHP files. The included code can expose sensitive data or bypass access controls. Executing attacker-supplied PHP requires an additional means of placing a suitable PHP file on the server.

Eventin through 4.1.22 checks only a wp_rest nonce in create_item_permissions_check() for /wp-json/eventin/v2/orders, while exposing that nonce to visitors through the etn-public script's localized_data_obj. create_item() accepts a caller-supplied status through prepare_item_for_database() without a whitelist. An unauthenticated attacker can create completed etn-order posts counted as sold by etn_get_sold_tickets_by_event(). Cleanup is scheduled only for pending orders, so the forged completed orders persist and exhaust ticket inventory.

WP Event Solution through 4.1.22 omits required authorization from an operation reachable without a WordPress account. An unauthenticated attacker can invoke the operation to change affected event or plugin state and disrupt related functionality.

Eventin before 4.1.19 does not constrain the changes authorized by a guest checkout token. An unauthenticated user can mark their own unpaid order completed and receive a valid paid ticket without payment.

Eventin before 4.1.22 fails to enforce publication status or ownership in a REST namespace. An unauthenticated attacker can retrieve other users' draft, pending, private, and password-protected posts, including the protected content and its password.

Eventin before 4.1.21 neither validates a webhook URL stored on an event nor verifies that the requester owns the target event. A Contributor or higher can supply an arbitrary host and trigger a blind server-side request from WordPress.

Eventin before 4.1.21 does not verify schedule ownership before allowing a record to be modified or deleted. A Contributor can select schedule entries created by another user and alter or remove them.

Eventin before 4.1.21 fails to verify ownership or capability before deleting a user account. A Contributor can select and permanently delete accounts belonging to other users.

Eventin before 4.1.21 does not verify permission to edit another user before assigning roles and updating user metadata during speaker creation. A Contributor can target another account and modify its role and metadata.

Eventin before 4.1.21 does not properly verify event ownership before modification, deletion or author reassignment. A Contributor can target events created by other users, including administrators, and alter, remove or take ownership of them.

WP Event SOlution is affected by sensitive information exposure. Exploitation requires an authenticated customer account. Successful exploitation can disclose data that should not be available to the caller. The published affected range is n/a through 4.1.18.

WP Event SOlution is affected by arbitrary content deletion. Exploitation requires an authenticated customer account. A successful request can delete WordPress content that the caller should not control. The published affected range is n/a through 4.1.19.

Eventin before 4.1.20 does not adequately restrict access to individual order records. A Contributor can iterate order identifiers and retrieve other customers' order data, including personal information.

Eventin before 4.1.20 exposes POST /eventin/v1/orders/waiting-list with a permission callback that returns true. add_to_waiting_list() prepares the request, creates a waiting OrderModel and attendees, then create_customer() accepts an arbitrary customer_email and first and last name. It either finds an existing account and assigns etn-customer or creates a WordPress user and associates it with the injected order. Version 4.1.20 requires a wp_rest X-WP-Nonce and respects users_can_register for guest creation. The exact full request schema, resulting role capabilities and practical strength of the front-end nonce requirement are not disclosed.

Eventin before 4.1.20 does not adequately restrict access to stored customer records. A Contributor can retrieve other customers' personal data, including names and email addresses.

Eventin before 4.1.20 does not adequately validate the local path stored in its speaker_template setting. An Editor or higher role can point the setting to an arbitrary local PHP file, causing the application to include and execute that file when the speaker template is rendered.

WP Event Solution through 4.1.9 contains an authentication flaw reachable without a WordPress account.

Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 4.1.15.

WP Event SOlution is affected by broken access control. The vulnerable path is reachable without authentication. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 4.1.12.

WP Event SOlution is affected by broken access control. The vulnerable path is reachable without authentication. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 4.1.8.

Eventin is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

Events Calendar, Event Booking, Registrations and Event Tickets – Eventin is affected by server-side request forgery. The vulnerable path is reachable without authentication. The vulnerable server can be induced to make attacker-selected network requests.

Eventin is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

Eventin is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess.

Event Manager, Events Calendar, Tickets, Registrations – Eventin is affected by filesystem traversal. Exploitation requires an authenticated contributor account. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

Event Manager, Events Calendar, Tickets, Registrations – Eventin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

Event Manager, Events Calendar, Tickets, Registrations – Eventin is affected by filesystem traversal. Exploitation requires an authenticated contributor account. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

Eventin is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Eventin is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Event Manager, Events Calendar, Tickets, Registrations – Eventin is affected by a security weakness. Exploitation requires an authenticated contributor account. The resulting impact depends on how the affected component exposes the vulnerable operation.