The Eventin WordPress plugin suffers from a missing authorization vulnerability (CWE-862) in the get_item_permissions_check() function. This flaw allows authenticated users with low privileges (Subscriber and above) to bypass proper capability checks and read arbitrary order data by iterating over order IDs. The exposed data includes customer PII such as names, emails, and phone numbers. The vulnerability affects all versions up to and including 4.1.8. The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low complexity, low privileges required, no user interaction, and impact limited to confidentiality loss.

An attacker with Subscriber-level access can access sensitive customer order information, including personally identifiable information (PII) such as names, emails, and phone numbers. This unauthorized data disclosure can lead to privacy violations and potential misuse of customer data. There is no impact on integrity or availability reported. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting Subscriber-level access or monitoring for unusual access patterns to order data. Avoid granting unnecessary permissions to low-privilege users. Follow updates from the plugin vendor or WordPress security channels for patch availability.