{
 "id": "WPSEC-2026-1998",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1998/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1998/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1998/index.md",
 "title": "WP Event Aggregator <= 1.9.3 - Authenticated (Subscriber+) Missing Authorization to Facebook OAuth Account Connection Overwrite",
 "description": "The WP Event Aggregator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Facebook OAuth callback (admin_post_wpea_facebook_authorize_callback) in all versions up to, and including, 1.9.3, where the only state check compared the request's state parameter against a client-controlled cookie. This makes it possible for authenticated attackers, with Subscriber-level access and above, to supply matching cookie and state values along with an authorization code for their own Facebook account, overwriting the site's stored Facebook access token, authorized user and page tokens.",
 "plugin": {
  "slug": "wp-event-aggregator",
  "name": "WP Event Aggregator",
  "full_name": "WP Event Aggregator: Import Eventbrite events, Meetup events, social events and any iCal Events into Event Calendar",
  "wordpress_org": "https://wordpress.org/plugins/wp-event-aggregator/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-event-aggregator/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-event-aggregator"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.9.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.9.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.9.4",
 "remediation": "Update to 1.9.4 or later.",
 "fix_released": "2026-10-29T07:22:59+00:00",
 "published": "2026-10-30T07:45:53+00:00",
 "updated": "2026-10-29T17:43:21.551545+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1998/",
  "https://plugins.svn.wordpress.org/wp-event-aggregator/tags/1.9.4/",
  "https://wordpress.org/plugins/wp-event-aggregator/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-event-aggregator",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}