A high-severity authorization bypass vulnerability exists in the EventON Action User plugin for WordPress that could allow unauthenticated attackers to perform unauthorized operations.

This is a missing authorization flaw (CWE-862) within the plugin, which fails to adequately verify user permissions during certain AJAX requests. The vulnerability is accessible to unauthenticated attackers, as indicated by the CVSS vector.

Successful exploitation allows unauthorized actors to execute administrative or user-level functions without proper authentication. This could lead to sensitive data exposure, unauthorized modification of event data, or other service disruptions, posing a significant risk to site integrity. The CVSS score of 7.3 reflects the high potential for impact on Confidentiality, Integrity, and Availability.

Immediate Action: Update the EventON Action User plugin to version 2.5.15 or later immediately to resolve the missing authorization flaw.

Proactive Monitoring: Review web server access logs for unusual patterns or spikes in AJAX request activity directed at the plugin, which may indicate attempted exploitation.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious or unauthorized requests targeting the plugin's AJAX endpoints.

Public Exploit Available: No

Given the ease of exploitation and the potential for unauthorized administrative actions, immediate patching is essential. Administrators should prioritize upgrading the EventON Action User plugin to the latest version to neutralize this risk and prevent potential compromise of their WordPress environment.