The EventON Action User plugin for WordPress admits unauthenticated requests to its evoau_save_capability AJAX endpoint without checking user permissions. This omission lets an attacker grant the Events‑Management and upload_files capabilities to any non‑administrator WordPress role or user, thereby elevating privileges. The same endpoint also exposes user enumeration data, role and capability states, nonce values and allows manipulation of event‑to‑user term assignments, expanding the potential damage beyond direct privilege escalation.

WordPress sites running EventON Action User up through version 2.5.14. Sites with any non‑administrator role or user are vulnerable because the elevation cannot target the administrator role, which is guarded by an early‑return logic in the plugin’s update_role_caps() function.

The vulnerability scores a CVSS of 7.3, indicating high severity, while its EPSS score is listed as < 1%, implying a very low likelihood of exploitation at present. It is not currently listed in the CISA KEV catalog. Attackers can exploit the issue remotely by crafting an unauthenticated POST request to the evoau_save_capability action, bypassing the missing authorization check and specifying target role or user identifiers; the plugin then assigns elevated capabilities or reveals sensitive user data, potentially leading to full site compromise.