CyberRota Analysis
AI-GeneratedThe Eventin WordPress plugin prior to version 4.1.24 is vulnerable as it fails to properly verify user capabilities when adding a speaker, allowing users with contributor-level access and higher to create new accounts with elevated privileges. This can lead to unauthorized account creation, enabling attackers to publish content and upload files. WordPress site administrators and security teams should prioritize this vulnerability to prevent potential exploitation and maintain the integrity of their systems.
Original NVD Description
The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and above to create new WordPress user accounts that carry capabilities beyond their own, including publishing content and uploading files, and, by supplying an email address they control, to obtain a working login to the created account.