The Eventin WordPress plugin contains an unauthenticated authorization bypass and script injection flaw that allows attackers to modify plugin settings and execute arbitrary code in victim browsers.

The plugin lacks a capability check on the post_settings function, allowing unauthenticated attackers to modify plugin configurations. Furthermore, the etn_primary_color setting fails to sanitize input, enabling unauthenticated attackers to inject malicious JavaScript that executes when administrative or public pages load the plugin styles.

Successful exploitation allows an unauthenticated attacker to alter site event management settings and inject malicious scripts. This poses a significant risk of site defacement, unauthorized redirection of users, and potential administrative account takeover via session theft. With a CVSS score of 7.2, this vulnerability is classified as High severity and requires immediate attention to prevent unauthorized site control.

Immediate Action: Update the Eventin plugin to the latest available version, which includes the necessary authorization checks and input sanitization, as indicated in the vendor changelog.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at the plugin's API endpoints and monitor for unexpected changes to plugin configuration settings.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized requests to the plugin's configuration endpoints and filter out common script injection patterns in HTTP request parameters.

Public Exploit Available: Unknown.

This vulnerability presents a high risk due to the lack of required authentication for critical administrative actions. IT administrators should prioritize updating the Eventin plugin across all WordPress instances immediately. If an update cannot be performed promptly, the plugin should be deactivated until a secure version is deployed to eliminate the exposure window.