CVE-2023-49756 is a medium severity (CVSS 5.4) missing authorization flaw in the Eventin (wp-event-solution) WordPress plugin through version 3.3.52. A logged in user with Subscriber rights can reach functions meant for higher roles. Patchstack lists 3.3.53 as the fixed version, so update the plugin.
What's affected
The NVD record says the issue affects Eventin from n/a through 3.3.52. The weakness is CWE-862 (missing authorization). The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, which needs a low privilege account and gives limited integrity and availability impact.
Patchstack's entry, titled as an authenticated notice dismissal flaw, rates the CVSS 5.4 as Medium, requires the Subscriber role and lists 3.3.53 as fixed. Its title mentions version 3.3.44 while the CVE record says through 3.3.52. Use the CVE range and update to 3.3.53 or later.
Fixed version: 3.3.53, per Patchstack. Confirm in the plugin changelog on WordPress.org. Sites that run many plugins should keep a simple list of names and versions, so an advisory like this takes minutes to answer instead of hours.
How to check if you're exposed
List installed plugins and versions with WP-CLI, or open Plugins in the WordPress admin.
wp plugin list --fields=name,version,update
Any Eventin version at or below 3.3.52 is in range. Sites that allow public registration are more exposed, because anyone can obtain the Subscriber role that the issue requires. Review your user registration settings. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages in a manifest against known CVEs. It only sees what you give it, so it will not find a firmware image or a hosted product on its own. Use it for the code you ship and your asset list for everything else.
What to do now
- Check every WordPress site you run for the wp-event-solution plugin.
- Update to 3.3.53 or later, test the event pages, and clear caches.
- If you cannot update now, deactivate the plugin or turn off open user registration.
- Review Subscriber accounts created recently and remove ones you do not recognize.
- Turn on automatic plugin updates for plugins with a good maintenance record.
Why it matters
Missing authorization means a function checks that a user is logged in but not whether that user is allowed to do the thing. A Subscriber can then call an action meant for administrators or editors.
The impact here is modest, which is why the score is medium. Even so, WordPress sites with open registration make low privilege roles easy to get, so small access control gaps add up. This CVE is not on the CISA KEV list.
Quick check
What role does an attacker need?
Patchstack lists Subscriber, the lowest logged in role.
Which version fixes it?
Patchstack lists 3.3.53.
Sources
Last reviewed: 19 October 2026.
