Eventin restores administrator-equivalent capabilities to a demoted user ID 1
Eventin through 4.1.23 registers PermissionManager::manage_permissions() on WordPress's map_meta_cap filter and returns the always-true exist primitive for every capability check when the evaluated user ID is 1. An attacker who can log in as user ID 1 therefore passes checks such as manage_options, promote_users, edit_plugins, edit_themes, and update_core even if that account was demoted to Subscriber. This enables administrator-equivalent site takeover and can permit code execution through plugin or theme editors where those editors are enabled. The condition is specific to a demoted user ID 1; there is no additional privilege gain when that account is already an administrator. No particular attack endpoint is required by the described global capability-filter flaw.
- Component
- Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce
- Plugin slug
wp-event-solution- Affected
- <= 4.1.23
- Safe version
- See mitigation notes
- Published
- Sep 15, 2026
This CVE was published Sep 15, 2026 and is one of 45 known issues for this plugin.
Update, patch or deactivate.
This archive could not verify a fixed version from the official author release notes reviewed on 2026-10-13. Disable the affected feature or component where practical until remediation for the deployed configuration is established. Prevent login to a demoted user ID 1 and disable the affected plugin until remediation is confirmed. The application-level fix must remove the blanket exist return, preserve core capability decisions for unrelated checks, and scope any custom mapping to explicitly supported Eventin capabilities with real role and object authorization. Official author release notes: https://wordpress.org/plugins/wp-event-solution/.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.1.23. This is due to the `PermissionManager::manage_permissions()` function being registered as a callback on WordPress core's `map_meta_cap` filter and unconditionally returning the always-true `'exist'` primitive for every capability check whenever the evaluated user ID is 1, without scoping this behavior to plugin-specific capabilities. This makes it possible for authenticated attackers whose account is user ID 1, even subscribers, to pass every WordPress capability check, including `manage_options`, `edit_plugins`, `edit_themes`, `promote_users`, and `update_core`, thereby elevating their privileges to administrator-equivalent power and achieving full site takeover, including remote code execution via the plugin and theme editors. Exploitation is only impactful when user ID 1 has been deliberately demoted to a lower-privilege role as a common administrator-account hardening practice; on default installations where user ID 1 retains the administrator role, no incremental privilege gain occurs.
CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H