The Eventin – Events Calendar plugin for WordPress has an improper capability check in the get_item_permissions_check() function in all releases up to and including 4.1.8. This flaw allows authenticated users with Subscriber-level access or higher to read arbitrary order data, exposing customer personally identifiable information such as name, email, and phone number. The weakness is categorized as Missing Authorization (CWE-862).

The vulnerability affects the WordPress plugin Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) from the vendor arraytics, for all versions up to 4.1.8 inclusive. Any WordPress site that has this plugin installed at those versions is susceptible to unauthorized disclosure of order data.

The CVSS score of 4.3 indicates a moderate severity level. The EPSS score is not provided, and the issue is not listed in CISA's KEV catalog. Attackers must be authenticated as a Subscriber or higher role; based on the description, it is inferred that the attacker can iterate through order IDs to retrieve data, but no explicit statement confirms the complexity or time required. Since subscriber accounts are common, the risk of exploitation is considered moderate but still significant due to the potential exposure of sensitive customer information.