Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Eventin plugin lets attackers gain admin rights

CVE-2025-47539 · published 1 year ago
Summary

The Eventin WordPress plugin (versions up to 4.0.26) can let a user with low privileges increase their access to full administrator level. This could allow them to change settings, add or delete content, or install other code. Update the plugin to the latest version or replace it with a secure alternative as soon as possible.

What to do
  • Update themewinter eventin to version 4.0.27 or later.
Affected software
VendorProductAffected versions
themewinter eventin < 4.0.27
cpe:2.3:a:themewinter:eventin:*:*:*:*:*:wordpress:*:*
Original advisory text
Incorrect Privilege Assignment vulnerability in Arraytics Eventin wp-event-solution allows Privilege Escalation.This issue affects Eventin: from n/a through <= 4.0.26.
Incorrect Privilege Assignment vulnerability in Arraytics Eventin wp-event-solution allows Privilege Escalation.This issue affects Eventin: from n/a through <= 4.0.26.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
25% chance of attack within 30 days
Type
CWE-266Incorrect Privilege Assignment
Timeline
Published23 May 2025
Updated30 Oct 2026
First seen7 Mar 2026
Sources
CVE-2025-47539 · NVD
Track software like this
Free during beta