The Eventin plugin for WordPress is vulnerable in versions up to 4.1.29 to a sensitive information exposure flaw. The issue allows an authenticated attacker with subscriber-level or higher access to retrieve the email address and phone number of any WordPress user, including administrators, by supplying that user's ID in an 'id' query‑string parameter. Attackers need only to be logged in and provide a valid user ID; the plugin fails to enforce proper authorization checks before exposing these fields.

WordPress sites using the Eventin Events Calendar, Tickets, Registration, Booking & WooCommerce plugin, any version 4.1.29 or earlier. No specific hardware or WordPress version is singled out, so all deployments of the affected plugin versions are at risk.

The vulnerability carries a CVSS score of 6.5, indicating a moderate severity that could compromise confidentiality of user contact information. Because the attacker must be authenticated, the threat is restricted to users already logged in; however, subscriber-level users are widely present on many sites. The EPSS score is unavailable, and the flaw is not currently listed in CISA's KEV catalog, suggesting no widespread active exploitation yet. Nevertheless, the exposure of personal data can lead to privacy violations and regulatory non‑compliance, warranting prompt remediation.