CVE-2026-109994: Eventin <= 4.1.29 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'id' Parameter

Q: Who can exploit this issue?

An authenticated WordPress user with at least Subscriber-level access can exploit it. The attacker does not need administrator privileges or user interaction.

Q: What information can be exposed?

An attacker can retrieve the email address and phone number of any WordPress user, including administrator accounts.

Q: What request conditions are required for exploitation?

The attacker must place their own authenticated user ID in the URL path and supply the target user's ID through the id query-string parameter.

Q: Are versions after 4.1.29 affected?

The available information identifies all Eventin versions through 4.1.29 as affected. It does not state whether any later version is affected or contains a fix.

Published Nov 6, 2026

Updated

The Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.1.29 via the 'id' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the email address and phone number of any WordPress user, including administrators, by supplying their user id in a query-string parameter while placing the authenticated user's own id in the URL path.

Event History

Nov 6, 2026

CVE Published

via MITRE·09:38 AM

Data Sourced

via MITRE·09:38 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated WordPress user with at least Subscriber-level access can exploit it. The attacker does not need administrator privileges or user interaction.

What information can be exposed?

An attacker can retrieve the email address and phone number of any WordPress user, including administrator accounts.

What request conditions are required for exploitation?

The attacker must place their own authenticated user ID in the URL path and supply the target user's ID through the id query-string parameter.

Are versions after 4.1.29 affected?

The available information identifies all Eventin versions through 4.1.29 as affected. It does not state whether any later version is affected or contains a fix.

CVE-2026-109994: Eventin <= 4.1.29 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'id' Parameter

Event History

Frequently Asked Questions

Who can exploit this issue?

What information can be exposed?

What request conditions are required for exploitation?

Are versions after 4.1.29 affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information can be exposed?

What request conditions are required for exploitation?

Are versions after 4.1.29 affected?