CVE-2025-47539
Published: 23 May 2025
Summary
CVE-2025-47539 is a critical-severity Incorrect Privilege Assignment (CWE-266) vulnerability in Themewinter Eventin. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 3.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-47539 is an Incorrect Privilege Assignment vulnerability, tracked under CWE-266, that affects the Arraytics Eventin plugin (wp-event-solution) for WordPress. The flaw permits privilege escalation and impacts all versions through 4.0.26.
The issue can be exploited remotely by unauthenticated attackers over the network. Successful exploitation grants full read, write, and administrative control over the affected WordPress site, corresponding to the maximum CVSS impact metrics.
Patchstack maintains a public advisory entry for the vulnerability that identifies the affected plugin versions and links to remediation guidance. The current EPSS score of 0.2790, with a recorded peak of 0.2986, indicates sustained moderate exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-28094
Vulnerability details
Incorrect Privilege Assignment vulnerability in Arraytics Eventin wp-event-solution allows Privilege Escalation.This issue affects Eventin: from n/a through <= 4.0.26.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Designation of a manager and policy dissemination ensures privileges are assigned according to defined roles.
Regular reviews catch incorrect privilege assignments to users, roles, or processes.
Explicitly specifying privileges and group/role memberships for accounts reduces the risk of incorrect privilege assignments.
The control requires explicit definition of separated access authorizations, making incorrect privilege assignments that bundle conflicting duties harder to implement.
Ensures privileges are assigned only as necessary rather than incorrectly over-granted.