The Eventin WordPress plugin attempts to restrict access to individual order records but fails to enforce proper authorization checks. Contributors and any role higher than contributor can iterate between order identifiers and read complete order details, including personal information about other customers. This constitutes an Insecure Direct Object Reference (IDOR) that enables unauthorized disclosure of private order data.

The vulnerability affects the Eventin WordPress plugin in all releases prior to 4.1.20. Any WordPress site that has installed this plugin with contributor-level users or higher is potentially exposed.

The flaw does not allow code execution or denial of service, but it does enable an authenticated user with contributor or higher privileges to compromise confidentiality of customer orders. Exploitation requires the attacker to know or guess order identifiers, which is trivial through enumeration. No CVSS score is available, and EPSS is not reported. The vulnerability is not listed in the CISA KEV catalog, yet the ease of exploitation on sites with many contributors makes it a moderate to high risk for data leakage.