Vincent Szopa

**Name of the Vulnerable Software and Affected Versions** EventON Action User versions prior to 2.5.15 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can exploit this to grant EventON management capabilities and the `upload files` capability to any non-administrator WordPress role or user, leading to privilege escalation. While the administrator role is protected by an early-return guard in the `update role caps()` function, the vulnerability allows attackers to enumerate all WordPress users including their IDs and display names, disclose role and user capability states with nonce values, and tamper with event-to-user term assignments via the `evoau save capability` AJAX endpoint. **Recommendations** Update EventON Action User to version 2.5.15 or later.