CyberRota Analysis
AI-GeneratedThe Eventin WordPress plugin prior to version 4.1.22 is vulnerable due to inadequate authorization checks on its event-management REST routes, enabling users with contributor-level access and higher to manipulate front-page settings and manage global event and speaker taxonomy terms without proper permissions. This could lead to unauthorized changes to site content and event management, potentially disrupting site integrity and user experience. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate these risks.
Original NVD Description
The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event and speaker taxonomy terms they should not be able to manage.