# WP Event Aggregator <= 1.9.3 - Authenticated (Subscriber+) Missing Authorization to Facebook OAuth Account Connection Overwrite

- **ID:** WPSEC-2026-1998
- **Plugin:** WP Event Aggregator: Import Eventbrite events, Meetup events, social events and any iCal Events into Event Calendar (`wp-event-aggregator`), https://wordpress.org/plugins/wp-event-aggregator/
- **Affected versions:** all versions before 1.9.4
- **Fixed in:** 1.9.4 (Update to 1.9.4 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-event-aggregator
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1998/

## Description

The WP Event Aggregator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Facebook OAuth callback (admin_post_wpea_facebook_authorize_callback) in all versions up to, and including, 1.9.3, where the only state check compared the request's state parameter against a client-controlled cookie. This makes it possible for authenticated attackers, with Subscriber-level access and above, to supply matching cookie and state values along with an authorization code for their own Facebook account, overwriting the site's stored Facebook access token, authorized user and page tokens.

## References

- https://wpsec.com/vuln/WPSEC-2026-1998/
- https://plugins.svn.wordpress.org/wp-event-aggregator/tags/1.9.4/
- https://wordpress.org/plugins/wp-event-aggregator/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1998/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.