CVE-2026-10033 is an authorization bypass vulnerability (CWE-862) in the EventON Action User WordPress plugin affecting all versions up to 2.5.14. The plugin fails to properly verify user authorization before performing sensitive actions. This enables unauthenticated attackers to assign EventON management and upload_files capabilities to any non-administrator role or user, effectively escalating their privileges within the WordPress site. The vulnerability also permits user enumeration with IDs and display names, disclosure of role and capability states including nonce values, and tampering with event-to-user term assignments. Administrator roles are protected by an early-return guard in the update_role_caps() function, limiting direct compromise of admin accounts. No official patch or remediation guidance is currently documented.

An unauthenticated attacker can escalate privileges by granting elevated capabilities to non-administrator users, potentially leading to unauthorized management of EventON features and file uploads. The vulnerability also allows attackers to enumerate all WordPress users and their roles, disclose sensitive capability and nonce information, and manipulate event-to-user relationships. This can result in significant compromise of site integrity and confidentiality, though administrator accounts have some protection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin and consider disabling it if possible. Monitor for updates from the vendor and apply patches promptly once released. Avoid granting unnecessary capabilities to non-administrator roles as a temporary mitigation.