CVE-2026-75983 is a privilege escalation vulnerability in the Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce WordPress plugin versions up to and including 4.1.23. The vulnerability is due to the `PermissionManager::manage_permissions()` function being registered on the WordPress `map_meta_cap` filter and unconditionally returning the always-true 'exist' capability for user ID 1. This behavior is not scoped to plugin-specific capabilities, allowing an attacker authenticated as user ID 1 but assigned a lower-privilege role to bypass all capability checks, including critical ones like `manage_options` and `update_core`. This results in administrator-equivalent privileges and enables full site compromise, including remote code execution through plugin and theme editors. Exploitation requires that user ID 1 has been deliberately demoted from administrator, a common security practice.

An attacker authenticated as user ID 1 with a lower-privilege role can escalate privileges to administrator level, gaining full control over the WordPress site. This includes the ability to manage options, edit plugins and themes, promote users, and update the core WordPress installation. The attacker can achieve full site takeover and execute remote code via the plugin and theme editors. However, this impact only applies if user ID 1 has been demoted from the administrator role; otherwise, no additional privilege escalation occurs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid demoting user ID 1 from the administrator role as a workaround to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once released.