CVE-2026-75983: 
WordPress vulnerability analysis and mitigation

CVE-2026-75983 is a Privilege Escalation vulnerability in the Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress, affecting all versions up to and including 4.1.23. The flaw allows an authenticated attacker whose account is assigned user ID 1 (even with a low-privilege role such as subscriber) to bypass all WordPress capability checks and gain administrator-equivalent access. It carries a CVSS v3.1 base score of 7.5 (High) with high complexity due to the specific precondition required (Feedly).

The root cause is Improper Privilege Management (CWE-269): the plugin's PermissionManager::manage_permissions() function is registered as a callback on WordPress core's map_meta_cap filter and unconditionally returns the always-true 'exist' primitive for every capability check whenever the evaluated user ID equals 1, without scoping this behavior to plugin-specific capabilities. This means any user account with database user ID 1 — regardless of their assigned WordPress role — passes every capability check, including sensitive ones such as manage_options, edit_plugins, edit_themes, promote_users, and update_core. The attack vector is network-based and requires no user interaction, but does require the attacker to be authenticated as the account with user ID 1 that has been deliberately demoted to a lower-privilege role (Feedly).

Successful exploitation grants the attacker full administrator-equivalent control over the WordPress site, enabling remote code execution via the plugin and theme editors, arbitrary file modification, user privilege manipulation, and complete site takeover. Confidentiality, integrity, and availability are all rated as high impact. The vulnerability is only impactful in hardened environments where user ID 1 has been deliberately demoted to a lower-privilege role; on default WordPress installations where user ID 1 retains the administrator role, no incremental privilege gain occurs (Feedly).

As of the disclosure date (September 15, 2026), no public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack complexity is rated High due to the specific precondition: the attacker must control the WordPress account assigned user ID 1 and that account must have been demoted to a non-administrator role. No threat actor attribution is currently available (Feedly).

1. Reconnaissance: Identify WordPress sites running the Eventin plugin (versions ≤ 4.1.23) where the account with user ID 1 has been demoted to a lower-privilege role (e.g., subscriber or editor) as a hardening measure.
2. Obtain credentials: Acquire valid credentials for the WordPress account with user ID 1 (e.g., through credential stuffing, phishing, or prior breach).
3. Authenticate: Log in to the WordPress site using the user ID 1 account with its low-privilege role.
4. Trigger capability bypass: Perform any action that invokes a WordPress capability check (e.g., accessing the admin dashboard, plugin editor, or theme editor). The Eventin plugin's PermissionManager::manage_permissions() callback intercepts the map_meta_cap filter and returns 'exist' for all capability checks for user ID 1, granting unconditional access.
5. Achieve full site takeover: With all capability checks bypassed, use the WordPress plugin or theme editor to upload or modify PHP files, achieving remote code execution, data exfiltration, or further lateral movement within the hosting environment (Feedly).

• Logs: WordPress authentication logs showing login activity for a low-privilege account (subscriber/editor) that subsequently accesses admin-only areas such as /wp-admin/plugin-editor.php or /wp-admin/theme-editor.php.
• Logs: PHP error logs or WordPress debug logs showing unexpected capability grants for user ID 1 with a non-administrator role.
• File System: Unexpected modifications to plugin or theme PHP files, or newly created PHP files in the WordPress installation directory, particularly following low-privilege user activity.
• Network: HTTP requests from a low-privilege session cookie accessing admin-restricted endpoints (e.g., POST /wp-admin/plugin-editor.php, POST /wp-admin/theme-editor.php).
• Process: Unusual server-side processes spawned by the web server user (e.g., www-data) following plugin/theme editor access.

Users should update the Eventin plugin to a version beyond 4.1.23 as soon as a patched release is made available by the vendor (Arraytics/Themewinter). As an immediate workaround, administrators should ensure that the WordPress account with user ID 1 retains the administrator role (the default configuration), which eliminates any incremental privilege gain from this vulnerability. Additionally, consider auditing user ID assignments and restricting access to the WordPress admin panel via IP allowlisting or two-factor authentication to reduce exposure (Feedly).

The vulnerability was noted on Mastodon by The Hacker Wire shortly after disclosure on September 15, 2026, and was picked up by several CVE aggregation and threat intelligence platforms including CVEFeed, VulDB, and Radar by Offseq. No major vendor statements or in-depth researcher write-ups have been published as of the disclosure date (Feedly).