CVE-2026-11821: Eventin WordPress Plugin Auth Bypass Flaw

CVE-2026-11821 Overview

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress contains an authorization bypass vulnerability. The flaw affects all plugin versions up to and including 4.1.17. The plugin fails to properly verify that a user is authorized to perform actions on notification flow event automation workflows. Authenticated users with subscriber-level access or above can view, create, update, clone, and delete workflows that should be restricted to administrators. The vulnerability is tracked under [CWE-862] Missing Authorization and was patched in version 4.1.18.

Critical Impact
Low-privileged subscriber accounts can manipulate administrator-only notification and automation workflows on affected WordPress sites.

Affected Products

Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin versions ≤ 4.1.17
WordPress sites running the vulnerable wp-event-solution plugin
Sites with subscriber registration enabled are at higher exposure

Discovery Timeline

2026-09-09 - CVE CVE-2026-11821 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-11821

Vulnerability Analysis

The vulnerability resides in the notification flow API of the Eventin plugin. The FlowAPI.php file within the bundled email-notification-sdk component registers REST endpoints for managing notification workflows. These endpoints govern automation flows tied to event notifications, including creation, updates, cloning, and deletion.

The registered endpoints do not perform an administrator-level capability check before executing sensitive operations. As a result, any authenticated WordPress user, including those with the default subscriber role, can invoke the endpoints and manipulate workflow objects. This breaks the intended trust boundary between administrative event operators and general site users.

Exploitation requires authentication but no user interaction. On WordPress deployments that allow open user registration, this reduces the attack barrier to registering a free account and issuing REST API calls against the vulnerable routes.

Root Cause

The root cause is a missing authorization check ([CWE-862]) in the permission_callback associated with the plugin's flow REST routes in FlowAPI.php. The callback did not enforce a capability such as manage_options before allowing state-changing actions on notification flow objects.

Attack Vector

The attack vector is network-based via the WordPress REST API. An attacker authenticates with any account of subscriber privilege or higher and issues HTTP requests to the plugin's flow endpoints. Successful requests allow reading existing workflows, injecting new automation logic, modifying triggers or actions, cloning workflows, and deleting them. See the Wordfence Vulnerability Report and the WordPress Plugin Changeset 3612206 for the corrective patch that adds the missing capability check.

Detection Methods for CVE-2026-11821

Indicators of Compromise

Unexpected REST API requests to plugin flow endpoints under /wp-json/ associated with wp-event-solution or the email-notification-sdk component from non-administrator sessions
New, modified, cloned, or deleted notification flow workflows in the Eventin admin interface with no corresponding administrator activity
Newly created subscriber accounts followed shortly by REST API activity targeting the flow routes

Detection Strategies

Review WordPress access logs for authenticated requests to FlowAPI routes originating from users whose role is subscriber, contributor, or author
Correlate WordPress user_id cookies or nonces in web server logs with the roles assigned to those users in the database
Compare the current workflow inventory against a known-good baseline exported from a trusted administrator session

Monitoring Recommendations

Enable WordPress audit logging to capture create, update, and delete actions on plugin data objects
Alert on REST API traffic to the plugin's flow endpoints outside expected administrator IP ranges or maintenance windows
Monitor for spikes in new subscriber registrations followed by REST API calls to /wp-json/ paths

How to Mitigate CVE-2026-11821

Immediate Actions Required

Update the Eventin plugin to version 4.1.18 or later, which introduces the missing capability check in FlowAPI.php
Audit existing notification flow workflows for unauthorized additions, modifications, or deletions
Review recently registered subscriber accounts and revoke any that show anomalous REST API activity

Patch Information

The vendor released a fix in Eventin plugin version 4.1.18. The patch adds a proper permission check to the flow API routes. Reference the fixed code in WordPress Plugin Version 4.1.18 and the diff in WordPress Plugin Changeset 3612206. The vulnerable pre-patch code is documented in WordPress Plugin Version 4.1.17.

Workarounds

Disable open user registration in WordPress settings until the plugin is updated
Restrict access to /wp-json/ REST API routes for unauthenticated and low-privilege users via a web application firewall rule
Temporarily deactivate the Eventin plugin on sites that cannot immediately upgrade to 4.1.18

bash

# Example WAF rule concept: block subscriber-level requests to plugin flow endpoints
# location ~ ^/wp-json/.*flow.* {
#     if ($http_x_wp_role !~ "administrator|editor") {
#         return 403;
#     }
# }