CVE-2026-11821: CWE-862 Missing Authorization in arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce

The Eventin WordPress plugin suffers from a missing authorization check (CWE-862) that enables authenticated users with low privileges (subscriber-level and above) to bypass intended access controls. This vulnerability allows such users to manipulate notification flow event automation workflows, which should be restricted to administrators. The issue affects all versions up to and including 4.1.17. No official patch or remediation guidance has been provided as of the published date. The CVSS v3.1 base score is 5.4, reflecting a medium severity with network attack vector, low complexity, and limited confidentiality and integrity impact.

Authenticated users with subscriber-level privileges or higher can bypass authorization controls to view and modify administrative notification workflows. This could lead to unauthorized changes in event automation processes, potentially disrupting event management or causing unintended notifications. The confidentiality and integrity impacts are limited but non-negligible. There is no indication of availability impact or known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access and above to trusted users only. Monitor for updates from the vendor regarding patches or official mitigations.