CVE-2026-10033

Name of the Vulnerable Software and Affected Versions EventON Action User versions prior to 2.5.15

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can exploit this to grant EventON management capabilities and the upload files capability to any non-administrator WordPress role or user, leading to privilege escalation. While the administrator role is protected by an early-return guard in the update role caps() function, the vulnerability allows attackers to enumerate all WordPress users including their IDs and display names, disclose role and user capability states with nonce values, and tamper with event-to-user term assignments via the evoau save capability AJAX endpoint.

Recommendations Update EventON Action User to version 2.5.15 or later.