{
 "id": "WPSEC-2026-1999",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1999/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1999/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1999/index.md",
 "title": "WP Event Aggregator <= 1.9.3 - Authenticated (Subscriber+) Missing Authorization to Meetup OAuth Account Connection Overwrite",
 "description": "The WP Event Aggregator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check, nonce and OAuth state verification on the Meetup OAuth callback (admin_post_wepa_meetup_authorize_callback) in all versions up to, and including, 1.9.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to submit an authorization code obtained for their own Meetup account and overwrite the site's stored Meetup access token and authorized user, linking the site's Meetup integration to an attacker-controlled account. The missing state check also allows an attacker to trick a logged-in administrator into connecting the site to the attacker's Meetup account.",
 "plugin": {
  "slug": "wp-event-aggregator",
  "name": "WP Event Aggregator",
  "full_name": "WP Event Aggregator: Import Eventbrite events, Meetup events, social events and any iCal Events into Event Calendar",
  "wordpress_org": "https://wordpress.org/plugins/wp-event-aggregator/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-event-aggregator/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-event-aggregator"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.9.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.9.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.9.4",
 "remediation": "Update to 1.9.4 or later.",
 "fix_released": "2026-10-29T07:22:59+00:00",
 "published": "2026-10-30T07:45:53+00:00",
 "updated": "2026-10-29T17:43:21.551545+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1999/",
  "https://plugins.svn.wordpress.org/wp-event-aggregator/tags/1.9.4/",
  "https://wordpress.org/plugins/wp-event-aggregator/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-event-aggregator",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}