PT-2025-32390 · WordPress · Eventin

István Márton · Published 2025-08-08 · Updated 2025-10-25 · CVE-2025-4796

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eventin versions through 4.0.34

Description The Eventin plugin for WordPress is susceptible to privilege escalation, potentially leading to account takeover. This occurs because the plugin does not adequately validate a user’s identity or capabilities before allowing updates to user details, such as email addresses. Specifically, the update item function within the EventinSpeakerApiSpeakerController class is affected. Unauthenticated attackers with contributor-level permissions or higher can exploit this flaw to modify the email addresses of any user, including administrators, and subsequently reset passwords to gain unauthorized access.

Recommendations Eventin versions prior to 4.0.34 are affected. Update to a version later than 4.0.34. As a temporary workaround, restrict access to the update item function within the EventinSpeakerApiSpeakerController class.

Fix

LPE

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-4796

Affected Products

Eventin

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-4796 · Security Note
• https://osv.dev/vulnerability/CVE-2025-4796 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/3336972/wp-event-solution/trunk/core/speaker/Api/SpeakerController.php#file0 · Patch
• https://wordfence.com/threat-intel/vulnerabilities/id/9e0d441d-1da5-45e7-8a14-ce178099c0cc?source=cve · Note
• https://twitter.com/Nxploited/status/1981929835174711544 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.0.28/core/speaker/Api/SpeakerController.php#L419 · Note
• https://twitter.com/CVEnew/status/1953892024198791590 · Twitter Post
• https://t.me/CVEtracker/29545 · Telegram Post
• https://twitter.com/CveFindCom/status/1953889060209951052 · Twitter Post