CVE-2026-75983: Eventin WordPress Plugin Privilege Escalation

CVE-2026-75983 Overview

The Eventin plugin for WordPress contains a privilege escalation flaw affecting all versions up to and including 4.1.23. The PermissionManager::manage_permissions() function is registered as a callback on WordPress core's map_meta_cap filter. It unconditionally returns the always-true 'exist' primitive for every capability check when the evaluated user ID is 1, without scoping the behavior to plugin-specific capabilities. Authenticated users whose account is user ID 1, including subscribers, can pass every WordPress capability check and gain administrator-equivalent power. The flaw is classified under [CWE-269] Improper Privilege Management.

Critical Impact
When user ID 1 has been demoted to a lower-privilege role as an administrator-hardening practice, that account can pass manage_options, edit_plugins, edit_themes, promote_users, and update_core checks, leading to full site takeover and remote code execution through the plugin and theme editors.

Affected Products

Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress
All versions up to and including 4.1.23
WordPress installations where user ID 1 has been demoted from the administrator role

Discovery Timeline

2026-09-15 - CVE CVE-2026-75983 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-75983

Vulnerability Analysis

Eventin registers PermissionManager::manage_permissions() as a callback on the WordPress core map_meta_cap filter. This filter maps a requested meta-capability to one or more primitive capabilities that WordPress then evaluates against a user's role. The plugin's implementation short-circuits this mapping whenever the evaluated user ID equals 1. It returns the 'exist' primitive, which WordPress treats as always granted.

Because the check applies to every capability rather than only to the plugin's own capabilities, WordPress core capabilities such as manage_options, edit_plugins, edit_themes, promote_users, and update_core all resolve to true for that user. An attacker who authenticates as user ID 1 can access the plugin and theme editors and write arbitrary PHP, achieving remote code execution on the host.

Root Cause

The root cause is unscoped logic inside a map_meta_cap filter callback. The function trusts the numeric user ID as a proxy for privilege rather than checking the current role or restricting the override to Eventin-specific capabilities. This inverts the WordPress trust model, in which user ID 1 is a database artifact and not a privilege signal.

Attack Vector

Exploitation requires authenticated access to the account holding user ID 1. The attack is impactful only when a site operator has deliberately demoted that account to a lower-privilege role such as subscriber, a common hardening step to protect the historical super-admin identifier. On default WordPress installations where user ID 1 retains the administrator role, no incremental privilege gain occurs. Once authenticated, the attacker submits standard WordPress admin requests to manage_options, plugin editor, or theme editor endpoints, which all pass the manipulated capability checks.

See the WordPress Access Control Permission Manager Code and Wordfence Vulnerability Report for technical details.

Detection Methods for CVE-2026-75983

Indicators of Compromise

Unexpected writes to files under wp-content/plugins/ or wp-content/themes/ originating from user ID 1 sessions
New administrator or elevated-role accounts created shortly after logins from a demoted user ID 1 account
Access log entries showing user ID 1 reaching plugin-editor.php, theme-editor.php, or options.php despite holding a low-privilege role
Presence of Eventin plugin versions at or below 4.1.23

Detection Strategies

Audit WordPress user metadata to identify sites where user ID 1 does not hold the administrator role, then correlate with Eventin installation status.
Instrument the map_meta_cap filter to log any grant of core capabilities such as edit_plugins, edit_themes, or update_core to non-administrator accounts.
Compare active plugin and theme file hashes against clean baselines to detect unauthorized modifications.

Monitoring Recommendations

Monitor authentication events and subsequent privileged action patterns for the user ID 1 account.
Alert on any modification to PHP files inside plugin and theme directories outside of scheduled maintenance windows.
Track outbound HTTP requests from the web server that could indicate a web shell staged through the theme or plugin editor.

How to Mitigate CVE-2026-75983

Immediate Actions Required

Update the Eventin plugin to a version above 4.1.23 that includes the vendor patch tracked in the WordPress Event Solution Changeset.
Identify whether user ID 1 has been demoted; if so, either restore its administrator role behind a strong credential or migrate ownership to a different account with a non-1 ID.
Rotate credentials for all administrator accounts and review recently created users for unauthorized elevation.

Patch Information

The vendor released a corrective changeset for the Eventin (wp-event-solution) plugin that scopes the PermissionManager::manage_permissions() behavior. Site operators should upgrade to the fixed release published after version 4.1.23 as noted in the Wordfence Vulnerability Report.

Workarounds

Temporarily deactivate the Eventin plugin until the patched version can be installed.
Disable the WordPress plugin and theme file editors by setting DISALLOW_FILE_EDIT to true in wp-config.php to remove the primary remote code execution path.
Restrict access to /wp-admin/ by IP allowlist at the web server or WAF layer while remediation is in progress.

bash

# Configuration example: disable in-dashboard file editing in wp-config.php
define( 'DISALLOW_FILE_EDIT', true );
define( 'DISALLOW_FILE_MODS', true );