Privilege Escalation in Eventin WordPress Plugin

The Eventin - Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to a privilege escalation flaw (CVE-2026-75983) affecting all versions up to and including 4.1.23. The issue stems from the PermissionManager::manage_permissions() function, which is improperly registered as a callback to the WordPress map_meta_cap filter. This function unconditionally returns the 'exist' capability for any check performed against user ID 1, regardless of the specific capability requested.

This vulnerability poses a significant risk to WordPress sites that have implemented security hardening by demoting the default user ID 1 from the Administrator role to a lower-privileged role (e.g., Subscriber). An attacker who gains control of the account associated with user ID 1 can effectively bypass all permission checks, enabling them to perform unauthorized administrative actions such as modifying site settings, promoting users, or installing arbitrary code via the plugin or theme editors. Sites where user ID 1 retains the default Administrator role remain at the same privilege level, as the bypass merely confirms existing administrative rights.

Impact

Successful exploitation allows an authenticated attacker possessing user ID 1 to achieve full administrative control over the target WordPress instance. This leads to total site takeover, potential data exfiltration, and the ability to execute arbitrary PHP code through administrative interfaces such as the theme or plugin editor. The vulnerability specifically targets environments where administrators have followed hardening practices by demoting the initial user account.

Recommendation

• Immediately update the Eventin plugin to a version released after 4.1.23 to patch CVE-2026-75983.
• Review all administrative accounts to ensure that user ID 1 is not assigned to a low-privileged account if it is not necessary for operation.
• Audit WordPress user accounts to identify if any account assigned user ID 1 has been granted unexpected roles or if that ID has been compromised.
• Implement file integrity monitoring on the WordPress /wp-content/plugins/ and /wp-content/themes/ directories to detect unauthorized code execution attempts following a potential privilege escalation.