WordPress Plugin Vulnerabilities

Eventin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR

Description

The plugin does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers.

Proof of Concept

Affects Plugins

Plugin icon
wp-event-solution
Fixed in 4.1.20

References

CVE
CVE-2026-13177

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
2.7 (low)

Miscellaneous

Original Researcher
Meher Sudhakar Abbireddi
Submitter
Meher Sudhakar Abbireddi
Verified
Yes
WPVDB ID
424f774d-9e09-4594-8732-9c527dfc748c

Timeline

Publicly Published
2026-08-10 (about 2 days ago)
Added
2026-08-10 (about 1 day ago)
Last Updated
2026-08-10 (about 1 day ago)

Other

Published
Title
Published
2026-01-02
Title
Overton <= 1.3 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2024-06-20
Title
User Profile Picture < 2.6.2 - Authenticated (Author+) Insecure Direct Object Reference to Profile Picture Update
Published
2026-01-02
Title
Justicia <= 1.2 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-06-29
Title
Simple User Avatar < 5.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-01-02
Title
Roam <= 2.1.1 - Authenticated (Subscriber+) Insecure Direct Object Reference