WP Event Aggregator <= 1.9.3 - Authenticated (Subscriber+) Missing Authorization to Meetup OAuth Account Connection Overwrite
- ID
- WPSEC-2026-1999
- Plugin
- WP Event Aggregator: Import Eventbrite events, Meetup events, social events and any iCal Events into Event Calendar (wp-event-aggregator)
- Affected
- all versions before 1.9.4
- Remediation
- Update to 1.9.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- WP Event Aggregator on WPSec AttackSurface
- Fix released
- Published
Description
The WP Event Aggregator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check, nonce and OAuth state verification on the Meetup OAuth callback (admin_post_wepa_meetup_authorize_callback) in all versions up to, and including, 1.9.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to submit an authorization code obtained for their own Meetup account and overwrite the site's stored Meetup access token and authorized user, linking the site's Meetup integration to an attacker-controlled account. The missing state check also allows an attacker to trick a logged-in administrator into connecting the site to the attacker's Meetup account.
References
- https://wpsec.com/vuln/WPSEC-2026-1999/
- https://plugins.svn.wordpress.org/wp-event-aggregator/tags/1.9.4/
- https://wordpress.org/plugins/wp-event-aggregator/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS