Authorization Flaw in Eventin WordPress Plugin Allows Unauthorized Event Management
CVE-2026-84901
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-84901?
The Eventin WordPress plugin is affected by a vulnerability that compromises authorization checks on several REST routes related to event management. Users with contributor-level access and higher can exploit this flaw to manipulate the site's front-page settings, changing them to events they do not own. Furthermore, they gain inappropriate access to create, edit, and delete global event and speaker taxonomy terms, allowing unauthorized management of content that should be restricted.
Affected Version(s)
Eventin 0 < 4.1.22
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.