PT-2025-21653 · WordPress · Wordpress Eventin

Denver Jackson · Published 2025-05-16 · Updated 2025-08-17 · CVE-2025-47539

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eventin versions n/a through 4.0.26

Description A critical privilege escalation flaw has been discovered in the Eventin WordPress plugin, allowing unauthenticated attackers to gain full admin access without the need for a login. This issue affects over 10,000 WordPress sites. The vulnerability is related to an incorrect privilege assignment, which enables attackers to create admin accounts. The flaw exposes Eventin sites to unauthenticated privilege escalation via a flawed REST API, leading to total site takeover.

Recommendations For Eventin versions n/a through 4.0.26, update to a version that contains a fix for this issue as soon as possible. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2025-47539

Affected Products

Wordpress Eventin

References · 16

• https://osv.dev/vulnerability/CVE-2025-47539 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-47539 · Security Note
• https://twitter.com/zoomeye_team/status/1923723665578848490 · Twitter Post
• https://t.me/pentestingnews/61467 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1923326509277696220 · Twitter Post
• https://twitter.com/Dinosn/status/1923313788528333239 · Twitter Post
• https://twitter.com/CVEnew/status/1925901320923349371 · Twitter Post
• https://twitter.com/Huntio/status/1924830833652761000 · Twitter Post
• https://twitter.com/mr_dineshpathro/status/1957009205560316335 · Twitter Post
• https://twitter.com/securecybernews/status/1923954068709572765 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/1927364177217163429 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/wp-event-solution/vulnerability/wordpress-eventin-4-0-26-privilege-escalation-vulnerability?_s_id=cve · Note
• https://twitter.com/FindSecCyber/status/1923972834889548229 · Twitter Post
• https://twitter.com/Nxploit1/status/1924089100463661165 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/wp-event-solution/vulnerability/wordpress-eventin-4-0-26-privilege-escalation-vulnerability?_s_id=cve · Note