How severe is CVE-2025-47539?

CVE-2025-47539 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2025-47539 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 31% (98th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-47539?

CVE-2025-47539 affects Themewinter Eventin. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-47539?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2025-47539 have an EU (EUVD) identifier?

Yes. CVE-2025-47539 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-28094.

When was CVE-2025-47539 published?

CVE-2025-47539 was published on 2025-05-23 and last updated on 2026-06-17.

CVE-2025-47539

CVE-2025-47539 is a critical-severity vulnerability in Themewinter Eventin with a CVSS 3.x base score of 9.8. Its EPSS exploit-prediction score of 31% places it in the 98th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-266.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
EPSS exploit prediction: 31% (98th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-28094
Weakness: CWE-266
Affected product: Themewinter Eventin
Published: 2025-05-23
Last modified: 2026-06-17

Description

Incorrect Privilege Assignment vulnerability in Arraytics Eventin wp-event-solution allows Privilege Escalation.This issue affects Eventin: from n/a through <= 4.0.26.

Frequently asked questions

What is CVE-2025-47539?: Incorrect Privilege Assignment vulnerability in Arraytics Eventin wp-event-solution allows Privilege Escalation.This issue affects Eventin: from n/a through <= 4.0.26.
How severe is CVE-2025-47539?: CVE-2025-47539 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2025-47539 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 31% (98th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-47539?: CVE-2025-47539 affects Themewinter Eventin. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-47539?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2025-47539 have an EU (EUVD) identifier?: Yes. CVE-2025-47539 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-28094.
When was CVE-2025-47539 published?: CVE-2025-47539 was published on 2025-05-23 and last updated on 2026-06-17.

References

https://patchstack.com/database/Wordpress/Plugin/wp-event-solution/vulnerability/wordpress-eventin-4-0-26-privilege-escalation-vulnerability?_s_id=cve

Affected products (1)

cpe:2.3:a:themewinter:eventin:*:*:*:*:*:wordpress:*:*

More vulnerabilities in Themewinter Eventin

CVE-2025-4796 — High (CVSS 8.8): The Eventin plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and…
CVE-2025-1770 — High (CVSS 8.8): The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File…
CVE-2024-7149 — High (CVSS 8.8): The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File…
CVE-2025-47445 — High (CVSS 7.5): Relative Path Traversal vulnerability in Arraytics Eventin wp-event-solution allows Path Traversal.This issue affects…
CVE-2025-3419 — High (CVSS 7.5): The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to arbitrary…
CVE-2025-39584 — High (CVSS 7.5): Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability…

All CVEs affecting Themewinter Eventin →

Other CWE-266 (Incorrect Privilege Assignment) vulnerabilities

CVE-2026-23800 — Critical (CVSS 10.0): Incorrect Privilege Assignment vulnerability in Modular DS modular-connector allows Privilege Escalation.This issue…
CVE-2025-41115 — Critical (CVSS 10.0): SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage…
CVE-2024-9479 — Critical (CVSS 10.0): Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege…
CVE-2024-9478 — Critical (CVSS 10.0): Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege…
CVE-2026-42368 — Critical (CVSS 9.9): A privilege escalation vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A…
CVE-2026-32922 — Critical (CVSS 9.9): OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with…

Browse all CWE-266 (Incorrect Privilege Assignment) vulnerabilities →