The Eventin plugin for WordPress suffers from an authorization bypass vulnerability (CWE-639) in the 'Eventin\Speaker\Api\SpeakerController::update_item' function. The plugin does not correctly verify the identity or permissions of users attempting to update email addresses, allowing attackers with contributor-level or above privileges to modify any user's email address. This can be exploited to reset passwords and take over accounts, including administrator accounts. The vulnerability affects all versions up to and including 4.0.34. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges at contributor level, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows attackers with contributor-level or higher permissions to escalate privileges by changing email addresses of arbitrary users, including administrators. This leads to account takeover through password reset, compromising the confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — no official patch or vendor advisory is provided in the available data. Users should monitor the vendor's official channels for updates and apply any forthcoming patches promptly. Until a fix is available, restrict contributor-level permissions and consider disabling or limiting the use of the Eventin plugin to reduce risk.