CVE-2026-75983
Received Received - Intake

Privilege Escalation in Eventin WordPress Plugin

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: Wordfence

Description
The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.1.23. This is due to the `PermissionManager::manage_permissions()` function being registered as a callback on WordPress core's `map_meta_cap` filter and unconditionally returning the always-true `'exist'` primitive for every capability check whenever the evaluated user ID is 1, without scoping this behavior to plugin-specific capabilities. This makes it possible for authenticated attackers whose account is user ID 1, even subscribers, to pass every WordPress capability check, including `manage_options`, `edit_plugins`, `edit_themes`, `promote_users`, and `update_core`, thereby elevating their privileges to administrator-equivalent power and achieving full site takeover, including remote code execution via the plugin and theme editors. Exploitation is only impactful when user ID 1 has been deliberately demoted to a lower-privilege role as a common administrator-account hardening practice; on default installations where user ID 1 retains the administrator role, no incremental privilege gain occurs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-75983
EUVD
EUVD-2026-78298

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
eventin event_calendar_tickets_registration_booking_woocommerce to 4.1.23 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Eventin WordPress plugin has a privilege escalation vulnerability in versions up to 4.1.23. The flaw is in the PermissionManager::manage_permissions() function, which incorrectly grants all capabilities to user ID 1 regardless of their actual role. This allows even low-privilege users to gain administrator-level access and take over the site.

Detection Guidance

Check if any user with ID 1 exists and verify their role. Inspect WordPress user tables for user ID 1 and confirm if it is assigned a non-administrator role. Review plugin files for the Eventin plugin version 4.1.23 or lower.

Impact Analysis

Attackers can exploit this to gain full control of a WordPress site if user ID 1 has been demoted from administrator. This includes executing remote code via plugin and theme editors. Default installations are less affected since user ID 1 is already an admin.

Compliance Impact

This vulnerability allows attackers to escalate privileges to administrator-equivalent levels, potentially granting full control over a WordPress site. For compliance with standards like GDPR or HIPAA, unauthorized administrative access could lead to data breaches, unauthorized modifications, or loss of audit trails, violating confidentiality and integrity requirements.

Mitigation Strategies

Update the Eventin plugin to the latest version. Remove or demote user ID 1 if it exists and is not needed. Audit all users with administrator privileges and ensure no unauthorized access has occurred.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75983. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart