CVE Catalog
CVE-2026-13174
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk0.14%
4th percentile - higher than 4% of all known CVEs
Summary
The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts.
Risk Assessment
Low-privileged users can permanently delete others' accounts, potentially leading to data loss and disruption of organizational operations.
Recommendation
Update the plugin to version 4.1.21 or later, which includes fixes for permission verification.
Original NVD description (English source)
The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts.