Eventin lets contributors create more privileged speaker accounts
Eventin before 4.1.24: A Contributor or higher can add a speaker without the capability required to create WordPress users. The operation can create an account with permissions beyond the caller's own, including publishing and uploading; supplying an attacker-controlled email can produce a usable login. The export does not name the account-creation handler or fields, and does not establish administrator-role creation.
- Component
- Eventin
- Plugin slug
wp-event-solution- Affected
- < 4.1.24
- Safe version
4.1.24- Published
- Sep 16, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Sep 16, 2026 and is one of 45 known issues for this plugin.
Update, patch or deactivate.
Update Eventin to 4.1.24 or later. Require user-creation permission before creating a linked speaker account and allowlist the assigned role without exceeding the caller's authority. Audit speaker-linked users and revoke unauthorized accounts.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and above to create new WordPress user accounts that carry capabilities beyond their own, including publishing content and uploading files, and, by supplying an email address they control, to obtain a working login to the created account.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N