Authorization Bypass Vulnerability in Event Calendar Plugin for WordPress
CVE-2026-11821

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce
Vendor
CVE Published:
9 September 2026

What is CVE-2026-11821?

The Eventin plugin for WordPress is susceptible to an authorization bypass vulnerability that affects all versions up to and including 4.1.17. This flaw arises from the plugin's inadequate verification process for user permissions, allowing authenticated attackers holding subscriber-level access or higher to bypass restrictions. Consequently, these users could access, create, update, clone, and delete automation workflows meant solely for administrators, potentially leading to unauthorized data manipulation and increased security risks.

Affected Version(s)

Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce 0 <= 4.1.17

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wp-event-solut...
https://plugins.trac.wordpress.org/browser/wp-event-solut...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sushi Com Abacate
.