Executive brief
The Eventin WordPress plugin before version 4.1.20 fails to properly restrict access to customer records through its REST API. Contributors and higher-privileged users can view sensitive personal information belonging to other customers, including names and email addresses, which should not be accessible to them. This breach of access controls exposes customer privacy data stored in WordPress event management systems.
Technical details
The vulnerability is an insecure direct object reference (IDOR) and authorization bypass in the Eventin plugin's REST API endpoints `/eventin/v2/customers` and `/eventin/v2/customers/{id}`. The plugin fails to enforce proper access control checks, allowing any authenticated user with Contributor role or above to enumerate and retrieve all stored customer records via REST API requests. The vulnerability requires authentication (Contributor-level account or above) and network access to the REST API. Attackers can exploit this by making authenticated REST API calls to read sensitive customer data such as names and email addresses. The issue was patched in version 4.1.20.
Affected products
- WP Event Solution Eventin before 4.1.20
Timeline
- 2026-08-10: disclosed: Publicly disclosed vulnerability
- 2026-08-12: patched: Fixed in version 4.1.20