User Account Creation Flaw in Eventin Plugin for WordPress
CVE-2026-84905
Key Information:
Badges
What is CVE-2026-84905?
The Eventin WordPress plugin prior to version 4.1.24 contains a significant security flaw that fails to verify user permissions properly. This oversight allows users with contributor-level access and higher to create new WordPress user accounts with elevated privileges. Consequently, these accounts can publish content, upload files, and gain access by entering an email address they control. This vulnerability exposes WordPress sites to potential account privileges abuse, making it crucial for site administrators to update to the latest version.
Affected Version(s)
Eventin 0 < 4.1.24
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.