CVE-2026-9701
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The Eventer plugin for WordPress up to version 4.4.2 stores the password reset key in plaintext in the `eventer_verification_code` user meta field. Combined with another vulnerability like SQL Injection (CVE-2026-9700), an unauthenticated attacker can extract this key and take over any user account, including administrators.
Risk Assessment
The risk for the organization is the potential complete takeover of administrator accounts, leading to unauthorized access to the WordPress admin panel, data theft, and further compromise of the website.
Recommendation
Immediately update the Eventer plugin to the latest available version that fixes this vulnerability. If no update is available, temporarily disable the plugin and consider using an alternative event management solution.
Other vulnerabilities in Eventer
See all- CVE-2026-27394High
The Eventer WordPress plugin in versions up to 0.1.1 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. Malicious script injected by an attacker executes in the victim's browser.
- CVE-2026-9700High
The Eventer plugin for WordPress is vulnerable to time-based SQL injection via the 'code' parameter in all versions up to and including 4.4.2 due to insufficient escaping and lack of proper SQL query preparation.
Original NVD description (English source)
The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugin stores a plaintext copy of the password reset key in the `eventer_verification_code` user meta field when a user requests a password reset. The plaintext key stored in `wp_usermeta` can be used with the plugin's custom reset action to set a new password for any user. Combined with another vulnerability such as SQL Injection (CVE-2026-9700), this makes it possible for unauthenticated attackers to extract the plaintext reset key and take over any user account, including administrators. Note: The password reset function only works up to PHP version 7.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS