Access violation vulnerability in Events Calendar, RSVP, Booking System & Event Tickets – Eventin 4.0.34

A plugin called Eventin for WordPress has a security issue that allows people to gain more privileges by taking over another user’s account. This can happen in all versions up to and including 4.0.34. The plugin doesn’t check the user’s identity properly before allowing them to update their email. This means that people without an account can change the email address of any user, even administrators. They can then use this to reset the user’s password and access their account.