EventON Action User Plugin Authorization Bypass in WordPress

The EventON Action User plugin for WordPress, across all versions up to and including 2.5.14, is affected by an authorization bypass vulnerability identified as CVE-2026-10033. This flaw stems from inadequate verification of user authorization when performing specific actions within the plugin. Unauthenticated attackers can leverage this vulnerability to grant EventON management and file upload capabilities to any non-administrator WordPress role or individual user, effectively escalating privileges within the compromised site. The vulnerability also enables attackers to enumerate WordPress users, including their IDs and display names, disclose role and user capability states, and tamper with event-to-user assignments. This exposes sensitive information and allows for significant control over the EventON plugin's features.

Attack Chain

1. An unauthenticated attacker identifies a WordPress site utilizing the vulnerable EventON Action User plugin (versions up to and including 2.5.14).
2. The attacker sends a specially crafted HTTP request, exploiting the authorization bypass, to a plugin-related endpoint on the WordPress site.
3. This request manipulates internal plugin functions responsible for managing user roles and capabilities, bypassing proper authentication and authorization checks due to insufficient verification.
4. The attacker successfully modifies the capabilities of a targeted non-administrator WordPress user or role, granting them elevated permissions such as EventON management and the upload_files capability.
5. With these escalated privileges, the attacker can then upload malicious files or gain unauthorized control over EventON functionalities within the WordPress environment.
6. Concurrently or independently, the attacker sends further crafted requests to enumerate all WordPress users, retrieving their IDs and display names.
7. Additional unauthenticated requests allow the disclosure of role and user capability states, along with sensitive nonce values.
8. The attacker achieves unauthorized privilege escalation and information disclosure, enabling further malicious activities on the compromised WordPress site.

Impact

Successful exploitation of CVE-2026-10033 allows unauthenticated attackers to significantly escalate their privileges within a targeted WordPress site. This includes granting themselves or other non-administrator users the ability to upload files and manage EventON features, which could lead to arbitrary code execution or website defacement. The ability to enumerate all WordPress user IDs, display names, and disclose capability states also presents a critical information disclosure risk, potentially aiding further targeted attacks or account compromise. No specific victim counts or industry sectors have been publicly identified, but any WordPress site running the vulnerable plugin is at risk.

Recommendation

• Immediately upgrade the EventON Action User plugin to a version greater than 2.5.14 to mitigate CVE-2026-10033.
• Monitor web server access logs for unusual HTTP POST or GET requests to EventON-related endpoints that attempt to modify user roles or capabilities, or enumerate users (log source: webserver).
• Enable logging for all WordPress user role and capability modifications, and regularly review these logs for unauthorized changes (log source: webserver, application_logs for WordPress specific actions).
• Consider implementing a Web Application Firewall (WAF) to detect and block suspicious requests targeting known WordPress vulnerabilities.