# CVE-2026-75983: Eventin Event Calendar privilege escalation via map_meta_cap filter

Source: https://junglewise.ai/threats/cve-2026-75983-eventin-event-calendar-privilege-escalation-via-map-meta-cap  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-75983 · Severity: high · CVSS 7.5 · Published 2026-09-15

The Eventin WordPress plugin incorrectly grants administrator-level permissions to any user with ID 1, regardless of their assigned role. An attacker who controls an account with user ID 1 can bypass all permission checks and gain full administrative access to the WordPress site, including the ability to install malicious plugins, modify site code, and execute arbitrary commands on the server. This affects installations where the default admin account (user ID 1) has been intentionally downgraded to a lower privilege level for security hardening.

Vendors: [Eventin](https://junglewise.ai/threats/vendors/eventin).

## Quick answers

**Is CVE-2026-75983 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75983 being exploited in the wild.

**How severe is CVE-2026-75983?** High severity, with a CVSS score of 7.5, published 15 September 2026.

**Which products and versions are affected?** Eventin Event Calendar, Tickets, Registration, Booking & WooCommerce up to and including 4.1.23.

**Is there a fix for CVE-2026-75983?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-75983 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-75983?** Check whether you run Eventin Event Calendar, Tickets, Registration or Booking & WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the `PermissionManager::manage_permissions()` function, which is registered as a callback on WordPress's `map_meta_cap` filter hook. This function unconditionally returns the boolean primitive `'exist'` (always-true) for every capability check when the evaluated user ID is 1, without restricting this behavior to plugin-specific capabilities. As a result, any user ID 1 account can bypass critical capability checks including `manage_options`, `edit_plugins`, `edit_themes`, `promote_users`, and `update_core`. The attack requires an authenticated account with user ID 1, but exploitation is only effective when that account has been deliberately demoted from the administrator role as part of account hardening. Default installations where user ID 1 retains the administrator role are not vulnerable to privilege escalation since no capability elevation occurs.

## Affected products

- Eventin Event Calendar, Tickets, Registration, Booking & WooCommerce up to and including 4.1.23

## Timeline

- 2026-09-15: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.21/core/AccessControl/PermissionManager.php](https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.21/core/AccessControl/PermissionManager.php)
- [https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.21/core/AccessControl/PermissionManager.php](https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.21/core/AccessControl/PermissionManager.php)