The Eventin plugin for WordPress is vulnerable to privilege escalation via account takeover, posing a critical risk to site administrative integrity.

The vulnerability exists in the Eventin/Speaker/Api/SpeakerController::update_item function, which fails to validate user capabilities. An attacker with contributor-level permissions can modify the email address of any user, including administrators, to perform a password reset and gain unauthorized full access.

Successful exploitation results in total compromise of the affected WordPress instance. Because the attacker can hijack administrator accounts, this vulnerability leads to unauthorized data access, potential exfiltration of sensitive site information, and the ability to inject malicious content or backdoors into the environment. With a CVSS score of 8.8, this flaw represents a high risk to business continuity and organizational security.

Immediate Action: Update the Eventin plugin to version 4.0.35 or higher immediately. If an update is not currently feasible, deactivate the plugin until a patch can be applied.

Proactive Monitoring: Review user account modification logs for suspicious activity, specifically looking for changes to administrator email addresses or unexpected password reset requests.

Compensating Controls: Deploy a Web Application Firewall with rules configured to block unauthorized requests targeting the Eventin API endpoints associated with the speaker controller.

Public Exploit Available: Yes, multiple public proof-of-concept repositories exist on GitHub.

The risk of account takeover via this vulnerability is severe and requires immediate attention. Administrators must verify their current plugin version and apply the vendor-supplied security update to prevent potential administrative compromise. Given the ease of exploitation, failure to patch may lead to a complete site takeover by unauthorized actors.