Insecure Password Reset Mechanism in Eventer Plugin for WordPress

CVE-2026-9701

What is CVE-2026-9701?

The Eventer plugin for WordPress is susceptible to an insecure password reset mechanism affecting all versions up to and including 4.4.2. When a user requests a password reset, the plugin stores the plaintext reset key in the eventer_verification_code user meta field. This enables unauthorized individuals to exploit the plaintext key stored in wp_usermeta and utilize it through the plugin's custom reset action to assign a new password to any account, including those of administrators. This vulnerability could be exploited in concert with other issues, such as SQL Injection, making it easier for attackers to obtain the plaintext reset key and potentially gain full control over any user account.

References