4.9
Moyenne
CVE-2026-84901 The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management…
Description
The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event and speaker taxonomy terms they should not be able to manage.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Eventin 4.1 | premières → < 4.1.22 | 4.1.22 |
Références
- wpscan.com wpscan.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Eventin
Les 18 CVE de Eventin →
CVE-2026-84906
The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is…
5.3
Moyenne
CVE-2026-84907
The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline (local)…
3.7
Faible
CVE-2026-84905
The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a…
2.7
Faible
CVE-2026-77702
The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used…
5.3
Moyenne