The Eventin plugin for WordPress contains a fault that allows any authenticated user with contributor-level privileges or higher to modify the email address of any other user. By changing an administrator’s email, the attacker can trigger a password reset and subsequently access the administrator account. This bypasses normal authorization controls and grants the attacker full control over the site, directly contradicting the intended role restrictions. The weakness corresponds to a failure of proper identity validation and is classified as a privilege escalation flaw.

WordPress sites running the Eventin plugin, versions 4.0.34 and earlier. The vulnerability is present in the SpeakerController update_item routine in the core files of the plugin; affected users include all registered WordPress accounts, with administrators being the most critical targets.

The CVSS score of 8.8 reflects high severity, while an EPSS score of less than 1% indicates that exploitation is currently rare but still possible. The vulnerability is not listed in the CISA KEV catalog, yet it can be exploited by any contributor+ user, a role that is commonly available on multi‑user WordPress installations. Exploitation requires no special skills beyond making a request to the API endpoint that updates speaker details; the lack of identity checks makes the attack straightforward. The high CVSS combined with the potential for full account takeover makes immediate remediation essential.