Executive brief
Eventin is a WordPress plugin providing event calendar and ticket booking functionality. The plugin fails to properly restrict access to notification automation workflows, allowing any authenticated user (even with basic subscriber permissions) to view, create, modify, and delete workflows that should only be available to site administrators. This could allow attackers to manipulate automated notifications, interfere with event operations, or access sensitive workflow configurations.
Technical details
The Eventin plugin is vulnerable to authorization bypass due to insufficient access controls on the notification flow event automation API endpoints in the email notification SDK. The vulnerable component (FlowAPI.php) does not properly verify user capabilities before allowing operations on notification workflows. An authenticated attacker with subscriber-level or higher privileges can send requests to create, read, update, clone, or delete workflows without proper role-based authorization checks. The vulnerability requires authentication but no additional preconditions, and allows attackers to manipulate administrative-level workflow configurations. A fix was introduced in version 4.1.18 which adds proper capability verification to the affected endpoints.
Affected products
- Eventin Eventin – Event Calendar, Event Registration, Tickets & Booking up to and including 4.1.17
Timeline
- 2026-09-09: disclosed
- 2026-09-09: patched: Fixed in version 4.1.18