Eventin WordPress Plugin Missing Authorization Vulnerability Allows Data Exposure

A vulnerability exists in the Eventin WordPress plugin, specifically in the Events Calendar, Event Booking, Ticket & Registration (AI Powered) version 4.1.8 and prior. The issue stems from an improper capability check in the 'get_item_permissions_check()' function, which fails to adequately restrict access to order data. This flaw enables authenticated attackers with Subscriber-level access or higher to read sensitive order information, including personal identifiable information (PII) such as names, email addresses, and phone numbers, by systematically iterating through order IDs.

Impact

Exploitation of this vulnerability could lead to unauthorized access and exposure of sensitive customer order information, including personal identifiable information (PII) such as names, email addresses, and phone numbers.

Remediation

Users are advised to update the Eventin WordPress plugin to version 4.1.9 or a newer patched version.