Skip to content
Threat Feed
Subscribe

Vendor

EventON

1 brief RSS
high advisory

EventON Action User Plugin Authorization Bypass in WordPress

An authorization bypass vulnerability (CVE-2026-10033) in the EventON Action User plugin for WordPress, affecting all versions up to and including 2.5.14, allows unauthenticated attackers to grant EventON management and file upload capabilities to non-administrator users, enumerate WordPress users, and tamper with event-to-user assignments, leading to privilege escalation.

EventON Action User plugin <= 2.5.14 +1 authorization-bypass privilege-escalation wordpress-plugin web-application cve
2t 1c