Description
The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Eventin | < 4.1.20 | 4.1.20 |
References
- https://wpscan.com/vulnerability/90240025-4dca-4bdb-9698-b63f4c60f413/ exploit vdb-entry technical-description