Eventer CVE-2026-9701

Exploitation requires (1) a target running Eventer 4.4.2 or earlier where a password reset has been or can be requested so that the plaintext key is written to the eventer_verification_code user_meta field, (2) a read primitive over the wp_usermeta table to recover that key - in the documented chain this is the SQL injection CVE-2026-9700 - and (3) the site running PHP 7.4 or earlier, because the plugin's reset function does not operate on PHP 8.x. Limiting factors: without the secondary key-disclosure flaw the stored key is not directly exposed to an unauthenticated attacker, and sites on modern PHP (8.0+) are not exploitable via the reset path, which substantially narrows realistic exposure below what the AV:N/AC:L/PR:N vector implies.

The NVD-style vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) reflects a best-case chained scenario: network, no privileges, no user interaction, full CIA loss via admin takeover. In practice two real limiters temper that score. First, the plaintext key is only useful once an attacker can read wp_usermeta, which requires a secondary disclosure primitive such as CVE-2026-9700 (SQLi) - the standalone flaw is a storage/design weakness, not a self-contained unauthenticated RCE. Second, the reset function only works on PHP 7.4 and earlier, which is end-of-life; modern hosts on PHP 8.x are not exploitable via this path. No EPSS score, KEV entry, or SSVC decision data was provided, and no POC is referenced, so exploitation probability cannot be quantified from the input. Net: genuinely high impact where the SQLi chain and legacy PHP both apply, but the PHP-7.4 gate meaningfully narrows the exploitable population versus the raw 9.8 suggests. The AC:L in the source vector is arguably optimistic given the required secondary flaw and PHP constraint.

On a target WordPress site running Eventer 4.4.2 on PHP 7.4, an unauthenticated attacker triggers a password reset for the administrator account, then exploits the chained SQL injection (CVE-2026-9700) to read the plaintext eventer_verification_code value from wp_usermeta. Using that key with the plugin's custom reset action, the attacker sets a new admin password and logs in with full control. No public POC is referenced, but the low complexity of the individual steps makes the chain straightforward where both preconditions hold.