A critical authentication bypass in the Eventin WordPress plugin permits unauthenticated attackers to register illicit user accounts and manipulate system order records.

The plugin fails to perform a capability check on its waiting-list registration handler, which permits unauthenticated remote attackers to interact with the registration endpoint to create new accounts and inject order data.

This vulnerability poses a significant risk to site integrity and user management security. An attacker could flood a system with fake user accounts or manipulate e-commerce records, potentially leading to unauthorized service access, financial discrepancies, and loss of consumer trust. With a CVSS score of 8.2, this flaw presents a high risk for organizations relying on the Eventin plugin for event management and ticketing.

Immediate Action: Update the Eventin plugin to version 4.1.20 or later immediately to apply the necessary authorization checks.

Proactive Monitoring: Review WordPress user registration logs for anomalous account creation activity and monitor order databases for unexpected entries that do not correspond to legitimate customer transactions.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access to the plugin's waiting-list registration endpoint until the update can be applied.

Public Exploit Available: Unknown.

Given the ease with which unauthenticated attackers can abuse this registration handler, administrators must prioritize patching this plugin immediately. Failure to update the software exposes the platform to persistent account injection and potential database corruption, which can be difficult to remediate retroactively.