Introduction
Attackers with contributor-level access can take over administrator accounts on thousands of WordPress sites running Eventin by changing an email address. The privilege escalation flaw, tracked as CVE-2025-4796, affects all Eventin plugin versions up to and including 4.0.34 and carries a CVSS score of 8.8.
Eventin is a WordPress event management plugin from Themewinter with over 10,000 active installations. It handles event scheduling, ticketing, and speaker management.
Technical Information
CVE-2025-4796 is in the Eventin\Speaker\Api\SpeakerController::update_item function, which updates speaker details, including sensitive fields such as email addresses. The function does not properly validate the identity or capability of the user making the request. Any authenticated user with contributor-level permissions or higher can therefore submit a request that changes the email address of any user, administrators included.
The attack follows a classic CWE-639 (Authorization Bypass Through User-Controlled Key) pattern. The vulnerable endpoint accepts a user-controlled identifier and never checks that the requester is authorized to update the targeted user's details. Once the attacker has changed an administrator's email address to one they control, they can use the standard WordPress password reset process to take over the account.
Affected code location:
Affected Systems and Versions
- Eventin WordPress plugin, all versions up to and including 4.0.34
- Any WordPress installation with Eventin <= 4.0.34 is vulnerable if it has users at contributor level or higher
Vendor Security History
Themewinter's Eventin plugin has had multiple critical vulnerabilities in 2025. CVE-2025-47539, an unauthenticated privilege escalation, was patched in version 4.0.27. Authorization flaws kept appearing in later versions (up to 4.0.34), which suggests ongoing problems with secure development practices and code review.
