CVE-2025-4796 Eventin <= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover
Authenticated contributors can escalate privileges to administrator by changing arbitrary user emails, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-4796?
CVE-2025-4796 is a high-severity vulnerability in arraytics Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered), published on 8 Aug 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Eventin plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.34. This is due to the plugin not properly validating a user's identity or capability prior to updating their details like email in the 'Eventin\Speaker\Api\SpeakerController::update_item' function. This makes it possible for unauthenticated attackers with contributor-level and above permissions to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
Weakness: CWE-639
Which versions are affected by CVE-2025-4796?
It affects 1 product.
Products include Themewinter Eventin.
How do I fix CVE-2025-4796?
No fix has been published for CVE-2025-4796 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-4796 being exploited?
There is no known exploitation of CVE-2025-4796 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in arraytics Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)
- CVE-2025-47539 WordPress Eventin plugin <= 4.0.26 - Privilege Escalation Vulnerability
- CVE-2025-1770 Path traversal in Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)
- CVE-2024-7149 Path traversal in Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)
- CVE-2025-47445 WordPress Eventin plugin <= 4.0.26 - Arbitrary File Download Vulnerability
- CVE-2025-3419 Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.26 - Unauthenticated Arbitrary File Read
Sources
Also known as GHSA-gr9c-3qfv-9cxq.