CVE-2026-9701: Eventer <= 4.4.2 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation
The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugin stores a plaintext copy of the password reset key in the eventerverificationcode user meta field when a user requests a password reset. The plaintext key stored in wpusermeta can be used with the plugin's custom reset action to set a new password for any user. Combined with another vulnerability such as SQL Injection (CVE-2026-9700), this makes it possible for unauthenticated attackers to extract the plaintext reset key and take over any user account, including administrators. Note: The password reset function only works up to PHP version 7.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Eventer WordPress pluginto a version that resolves this vulnerability.Fixed in 4.4.2 - Operational
After upgrading, invalidate any password-reset flows and ensure users re-authenticate with newly issued passwords, since the plaintext reset key is stored in the wp_usermeta field `eventer_verification_code` and could be used to set passwords for any user.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9701?
CVE-2026-9701 has a critical severity rating of 9.8.
How do I fix CVE-2026-9701?
To fix CVE-2026-9701, upgrade the Eventer plugin to version 4.4.3 or later.
What is the risk associated with CVE-2026-9701?
CVE-2026-9701 poses a risk score of 86, indicating it is highly vulnerable to exploitation.
What kind of vulnerability is CVE-2026-9701?
CVE-2026-9701 is an insecure password reset mechanism leading to unauthenticated privilege escalation.
Which versions of the Eventer plugin are affected by CVE-2026-9701?
CVE-2026-9701 affects all versions of the Eventer plugin up to and including 4.4.2.