WordPress Plugin Vulnerabilities

Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Authenticated (Customer+) Arbitrary Content Deletion

Description

The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.1.19. This makes it possible for authenticated attackers, with Custom-level access and above, to delete arbitrary content.

Affects Plugins

Plugin icon
wp-event-solution
Fixed in 4.1.20

References

CVE
CVE-2026-28173
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/a3157123-2eea-4f8b-bfc1-07633ad84c2b

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
VanTastic
Verified
No
WPVDB ID
1e5f94dd-fef6-4a51-bb10-b6ca821f82d0

Timeline

Publicly Published
2026-08-13 (about 1 month ago)
Added
2026-08-20 (about 23 days ago)
Last Updated
2026-08-20 (about 23 days ago)

Other

Published
Title
Published
2023-12-05
Title
RegistrationMagic < 5.2.3.1 - Missing Authorization
Published
2026-09-08
Title
ilGhera Reviso Exporter for WooCommerce < 1.2.4 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function
Published
2022-04-25
Title
ShortPixel Adaptive Images < 3.4.0 - Subscriber+ Arbitrary Settings Update
Published
2025-10-15
Title
Classified Pro < 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation
Published
2026-04-23
Title
WPBot – AI ChatBot for Live Support, Lead Generation, AI Services < 7.9.9 - Missing Authorization