What the vulnerability does
01Description
The Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the get_item_permissions_check() function in all versions up to, and including, 4.1.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary order data including customer PII (name, email, phone) by iterating order IDs.
Explanation of Vulnerability in Simple Terms
02Summary
Eventin versions up to 4.1.8 lack proper authorization checks, allowing authenticated users to access sensitive information they should not be able to view. An attacker with a low-privilege account can read data belonging to other users or the site without additional interaction. This affects the confidentiality of event registration, ticket, and booking information stored in the plugin.
What an attacker can do
03Attacker Capabilities
Read sensitive event, registration, ticket, or booking data belonging to other users or the site.
Potential impact on your site
04Site Impact
User data in events, registrations, tickets, and bookings may be exposed to other authenticated users on your site.
Conditions required to exploit
05Prerequisites
Attacker must have a valid low-privilege account on the site (e.g., subscriber or customer role).
Key dates
06Disclosure timeline
April 14, 2026
CVE published
April 14, 2026
Record updated
