CVE-2026-9701
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The Eventer plugin for WordPress up to version 4.4.2 stores the password reset key in plaintext in the `eventer_verification_code` user meta field. Combined with another vulnerability like SQL Injection (CVE-2026-9700), an unauthenticated attacker can extract this key and take over any user account, including administrators.
Risk Assessment
The risk for the organization is the potential complete takeover of administrator accounts, leading to unauthorized access to the WordPress admin panel, data theft, and further compromise of the website.
Recommendation
Immediately update the Eventer plugin to the latest available version that fixes this vulnerability. If no update is available, temporarily disable the plugin and consider using an alternative event management solution.
Original NVD description (English source)
The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugin stores a plaintext copy of the password reset key in the `eventer_verification_code` user meta field when a user requests a password reset. The plaintext key stored in `wp_usermeta` can be used with the plugin's custom reset action to set a new password for any user. Combined with another vulnerability such as SQL Injection (CVE-2026-9700), this makes it possible for unauthenticated attackers to extract the plaintext reset key and take over any user account, including administrators. Note: The password reset function only works up to PHP version 7.4.