Eventin Plugin Missing Authorization Check Enables Account Creation

The Eventin WordPress plugin before version 4.1.20 contains a critical authorization bypass vulnerability in its waiting-list registration handler. This flaw allows unauthenticated attackers to create arbitrary WordPress user accounts and inject fraudulent order records without proper permission validation. Any WordPress site running the vulnerable plugin version is at risk, particularly those using Eventin for event management and ticketing. The vulnerability is especially dangerous because it enables account takeover scenarios and data manipulation at scale, potentially compromising site integrity and user trust.

While this CVE does not map to specific MITRE ATT&CK techniques, Casky's 754 security skills—powered by Claude AI's extended reasoning—would identify the underlying attack patterns associated with this vulnerability. Practitioners using Casky would detect indicators aligned with T1078 (Valid Accounts) and T1078.001 (Default Accounts), as the vulnerability enables unauthorized account creation. Security teams would also see patterns consistent with T1190 (Exploit Public-Facing Application) since the waiting-list handler is exposed without authentication. During incident investigation, Casky's skill engine would surface findings related to missing input validation (CWE-284: Improper Access Control) and help practitioners correlate suspicious account creation logs, unexpected order records, and unauthenticated API calls to the registration endpoint—enabling faster threat detection and response.