CVE-2026-10033

The CVE concerns the WordPress plugin EventON Action User, affected up to version 2.5.14. The underlying issue is an authorization bypass in an action (evoau_save_capability AJAX action) that allows unauthenticated attackers to grant EventON management capabilities and the upload_files capability...