Eventin WordPress Plugin CVE-2026-84901

The target WordPress site must have the Eventin plugin installed and active in a version prior to 4.1.22. The attacker must hold at minimum a Contributor-level WordPress account on the target site - this is the critical prerequisite, limiting exposure on sites where contributor self-registration is disabled. No special plugin configuration or non-default setting is required beyond default installation of the plugin. No administrator interaction or victim user interaction is required once the attacker is authenticated. Exploitation is limited to integrity impact (front-page and taxonomy manipulation); confidentiality and availability are not affected.

The provided CVSS vector (PR:H) directly conflicts with the vulnerability description, which states that contributor-level access suffices - Contributors are low-privilege users in WordPress (PR:L is the accurate metric for this role). With a corrected PR:L, the effective CVSS base score would be higher than the reported 4.9. Real-world integrity impact is limited but meaningful: an attacker can hijack the site's front-page assignment and pollute global taxonomy structures, causing visible content disruption on multi-author sites without code execution or data exfiltration. EPSS of 0.13% (3rd percentile) and SSVC exploitation status of none indicate no widespread active abuse, and SSVC automatable: no reduces mass-exploitation risk. Despite the publicly available PoC, this is a medium-priority finding for sites with untrusted contributor accounts and a low priority for sites with tightly controlled user bases.

An attacker who has registered or been granted a WordPress Contributor account on a target site sends crafted HTTP requests to the Eventin REST API endpoints, omitting or bypassing the authorization checks that should restrict the action to administrators. The attacker redirects the site's front page to an event post they do not own, causing visitor-facing content disruption, or systematically alters global taxonomy terms to corrupt event category listings across the site. A publicly available PoC from WPScan lowers the technical barrier to exploitation.