The Eventin WordPress plugin before version 4.1.20 does not properly restrict access to individual order records. Users with contributor-level access and above can exploit this flaw by iterating order identifiers to read other customers' order data, including personal information. This is an authorization bypass vulnerability categorized under CWE-639 (Authorization Bypass Through User-Controlled Key). No CVSS score or official remediation level is provided, and no patch or fix is explicitly stated in the available data.

Unauthorized users with contributor-level access or higher can read sensitive order information belonging to other customers. This exposure includes personal data, potentially leading to privacy violations and data leakage. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access carefully and monitor for suspicious activity related to order data access. Avoid granting contributor or higher privileges to untrusted users.