CVE-2026-13173: Eventin < 4.1.21 - Contributor+ User Role and Meta Modification via Speaker Creation
The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creation, allowing users with contributor-level access and above to modify other users' roles and metadata.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Eventin WordPress pluginto a version that resolves this vulnerability.Fixed in 4.1.21 - Compensating control
Temporarily restrict who can access/create speakers in the WordPress admin (e.g., limit to trusted administrators/editors) until Eventin is upgraded to 4.1.21 or later.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with contributor-level access or higher can exploit it. The affected functionality allows those users to modify other users' roles and metadata while creating a speaker.
What versions are affected?
Eventin versions before 4.1.21 are affected. Updating to version 4.1.21 or later addresses the described permission-verification issue.
What is the potential impact?
A contributor or higher-privileged user may be able to alter another user's assigned role and user metadata. This could allow unauthorized changes to account permissions or account-related settings.