CVE-2026-13173
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creation, allowing users with contributor-level access and above to modify other users' roles and metadata.
Risk Assessment
Low-privileged users can escalate their privileges or change others' roles, potentially leading to unauthorized access to administrative functions.
Recommendation
Update the plugin to version 4.1.21 or later, which includes fixes for permission verification.
Original NVD description (English source)
The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creation, allowing users with contributor-level access and above to modify other users' roles and metadata.