Executive brief
The Eventin WordPress plugin used to manage event speaker profiles fails to verify user permissions when creating speaker accounts. This allows contributors and higher-level users to create new WordPress accounts with elevated capabilities (such as publishing and file uploads) that exceed their own permissions. An attacker can then log in to these accounts using a controlled email address to escalate privileges within the WordPress site.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the speaker creation functionality. When a contributor-level user adds a speaker via the plugin, it does not validate whether that user has the capability to create WordPress user accounts. An attacker with contributor access can craft a request to create a speaker, which internally generates a new WordPress user with elevated capabilities (Editor or Administrator role equivalent). By supplying an email address under their control, the attacker receives account credentials and gains unauthorized administrative or editorial access to the site. The issue affects Eventin versions before 4.1.24 and requires no authentication bypass—only the ability to access the speaker creation feature as a logged-in contributor.
Affected products
- Eventin Eventin before 4.1.24
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Fixed in version 4.1.24