Critical Flaw in Eventin Plugin Grants Hackers Full Access to 10,000+ WordPress Sites
A newly discovered security flaw in the widely used Eventin plugin for WordPress has left over 10,000 websites dangerously exposed to full system takeover — no password required.
Catalogued as CVE-2025-47539, this privilege escalation vulnerability allows threat actors to instantly grant themselves admin-level access — all without any existing credentials or user interaction. Once exploited, the attacker can completely control the website: altering content, stealing sensitive data, injecting malicious code, or even incorporating the site into a botnet for broader cyberattacks.
Eventin, developed by Themewinter, is a go-to plugin for event management on WordPress websites. Its widespread integration across business, education, and entertainment sites makes the discovery especially alarming.
What’s the Risk?
At the root of the issue lies a dangerously permissive API endpoint:/wp-json/eventin/v2/speakers/import
This endpoint failed to properly authenticate users, and worse — it accepted user-import data containing administrator roles without verification. The permission check function used in the codebase essentially nullified any gatekeeping:
php
public function import_item_permissions_check($request) {
return true;
}
This means anyone — even without logging in — could upload a crafted CSV file assigning themselves administrator privileges and reset the password to take over the site.
Who Found It?
The vulnerability was responsibly disclosed by security researcher Denver Jackson through Patchstack’s Zero Day initiative on April 19, 2025, earning a $600 bounty. Patchstack’s team confirmed the exploit and worked with the vendor to ensure a patch was promptly issued.
How Was It Fixed?
Themewinter responded with a security fix in version 4.0.27, released on April 30, 2025. The update includes proper capability checks to restrict access to the import function:
php
public function import_item_permissions_check($request) {
return current_user_can(‘etn_manage_organizer’) || current_user_can(‘etn_manage_event’);
}
It also now limits which user roles can be imported, preventing attackers from assigning themselves elevated privileges.
What Should You Do?
If your site runs the Eventin plugin, update immediately to version 4.0.27 or newer. Delaying this action could leave your site wide open to attack.
For those who are unable to update right away, temporarily deactivating the plugin is strongly advised until a secure version can be deployed. The exploit’s unauthenticated nature makes it especially potent — attackers don’t need access credentials, only an open API.
