Executive brief
The Eventin WordPress plugin incorrectly grants administrator-level permissions to any user with ID 1, regardless of their assigned role. An attacker who controls an account with user ID 1 can bypass all permission checks and gain full administrative access to the WordPress site, including the ability to install malicious plugins, modify site code, and execute arbitrary commands on the server. This affects installations where the default admin account (user ID 1) has been intentionally downgraded to a lower privilege level for security hardening.
Technical details
The vulnerability exists in the `PermissionManager::manage_permissions()` function, which is registered as a callback on WordPress's `map_meta_cap` filter hook. This function unconditionally returns the boolean primitive `'exist'` (always-true) for every capability check when the evaluated user ID is 1, without restricting this behavior to plugin-specific capabilities. As a result, any user ID 1 account can bypass critical capability checks including `manage_options`, `edit_plugins`, `edit_themes`, `promote_users`, and `update_core`. The attack requires an authenticated account with user ID 1, but exploitation is only effective when that account has been deliberately demoted from the administrator role as part of account hardening. Default installations where user ID 1 retains the administrator role are not vulnerable to privilege escalation since no capability elevation occurs.
Affected products
- Eventin Event Calendar, Tickets, Registration, Booking & WooCommerce up to and including 4.1.23
Timeline
- 2026-09-15: disclosed