CVE-2026-75983: Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter
The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.1.23. This is due to the PermissionManager::managepermissions() function being registered as a callback on WordPress core's mapmetacap filter and unconditionally returning the always-true 'exist' primitive for every capability check whenever the evaluated user ID is 1, without scoping this behavior to plugin-specific capabilities. This makes it possible for authenticated attackers whose account is user ID 1, even subscribers, to pass every WordPress capability check, including manageoptions, editplugins, editthemes, promoteusers, and updatecore, thereby elevating their privileges to administrator-equivalent power and achieving full site takeover, including remote code execution via the plugin and theme editors. Exploitation is only impactful when user ID 1 has been deliberately demoted to a lower-privilege role as a common administrator-account hardening practice; on default installations where user ID 1 retains the administrator role, no incremental privilege gain occurs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerceto a version that resolves this vulnerability.Fixed in 4.1.23 - Compensating control
If you cannot immediately upgrade, prevent non-administrators from using user ID 1 by enforcing that only a true administrator account retains the user ID 1 role (the described exploitation is only impactful when user ID 1 has been deliberately demoted to a lower-privilege role).
Event History
Frequently Asked Questions
Which sites have meaningful exposure to this issue?
The issue is impactful only where WordPress user ID 1 was deliberately assigned a lower-privilege role, such as Subscriber. On default installations where user ID 1 remains an administrator, it provides no incremental privilege gain.
What does an attacker need to exploit it?
An attacker must be authenticated to WordPress as the account whose user ID is 1. That account can be as low-privileged as Subscriber if it has been demoted.
What access can a successful attacker obtain?
The affected account can pass all WordPress capability checks, including manage_options, edit_plugins, edit_themes, promote_users, and update_core. This provides administrator-equivalent control and can lead to full site takeover, including remote code execution through plugin or theme editors.
How can I determine whether my site is affected in practice?
Check whether the Eventin plugin version is 4.1.23 or earlier, then determine the role assigned to the WordPress account with user ID 1. The practical escalation condition exists when that account has been demoted below administrator.