WP Event Aggregator <= 1.9.3 - Authenticated (Subscriber+) Missing Authorization to Facebook OAuth Account Connection Overwrite
- ID
- WPSEC-2026-1998
- Plugin
- WP Event Aggregator: Import Eventbrite events, Meetup events, social events and any iCal Events into Event Calendar (wp-event-aggregator)
- Affected
- all versions before 1.9.4
- Remediation
- Update to 1.9.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- WP Event Aggregator on WPSec AttackSurface
- Fix released
- Published
Description
The WP Event Aggregator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Facebook OAuth callback (admin_post_wpea_facebook_authorize_callback) in all versions up to, and including, 1.9.3, where the only state check compared the request's state parameter against a client-controlled cookie. This makes it possible for authenticated attackers, with Subscriber-level access and above, to supply matching cookie and state values along with an authorization code for their own Facebook account, overwriting the site's stored Facebook access token, authorized user and page tokens.
References
- https://wpsec.com/vuln/WPSEC-2026-1998/
- https://plugins.svn.wordpress.org/wp-event-aggregator/tags/1.9.4/
- https://wordpress.org/plugins/wp-event-aggregator/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS