EUVD-2026-42163
GHSA-qhrf-5rv2-gph8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Full account takeover gives C/I/A High, but reliable exploitation needs a secondary key-disclosure flaw and PHP ≤7.4, so AC:H rather than the source vector's AC:L.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugin stores a plaintext copy of the password reset key in the eventer_verification_code user meta field when a user requests a password reset. The plaintext key stored in wp_usermeta can be used with the plugin's custom reset action to set a new password for any user. Combined with another vulnerability such as SQL Injection (CVE-2026-9700), this makes it possible for unauthenticated attackers to extract the plaintext reset key and take over any user account, including administrators. Note: The password reset function only works up to PHP version 7.4.
Articles & Coverage 2
AnalysisAI
Account takeover in the Eventer WordPress event-manager plugin (all versions through 4.4.2) stems from the plugin writing the password-reset key in cleartext to the eventer_verification_code field in wp_usermeta; any actor who can read that value can drive the plugin's custom reset action to set an arbitrary password for any user, including administrators. Chained with the companion SQL injection flaw CVE-2026-9700, remote attackers can extract the stored key without authentication and fully hijack accounts. There is no public exploit identified at time of analysis, and exploitation is constrained to sites running PHP 7.4 or earlier, where the reset routine functions.
Technical ContextAI
Eventer is a commercial WordPress event-management plugin (CPE cpe:2.3:a:joe007:eventer) that implements its own password-reset workflow rather than relying on WordPress core. When a reset is requested, the plugin generates a verification key and persists a plaintext copy in the eventer_verification_code user_meta row, then exposes a custom reset action that accepts that key to set a new password. The root cause maps to CWE-289 (Authentication Bypass by Alternate Name): the plugin's alternate, self-built reset path trusts a secret that it has itself stored in readable form, so possession of the meta value alone authenticates the password change. Because the key lives in the standard wp_usermeta table, any read primitive over that table - such as SQL injection - yields the secret. The plugin's own note that the reset only functions up to PHP 7.4 indicates the vulnerable code path depends on behavior removed or broken in PHP 8.x.
RemediationAI
No vendor-released patch identified at time of analysis - the description marks all versions through 4.4.2 as vulnerable and the references (Wordfence threat intel and the CodeCanyon listing) do not cite a fixed release, so administrators should monitor CodeCanyon for an update newer than 4.4.2 and apply it once published, then invalidate existing sessions and force a password reset for all accounts. Until a fix ships, the highest-value compensating control is to close the companion read primitive: patch or virtually-patch the SQL injection (CVE-2026-9700) via a WAF rule so the plaintext key cannot be extracted, since the takeover is impractical without it. Additional interim controls include deleting stale eventer_verification_code rows from wp_usermeta, disabling the plugin's custom password-reset feature if it is not needed, and restricting or blocking access to the plugin's reset action endpoint; note these may break legitimate self-service password reset for event users. Migrating hosts to PHP 8.x also disables the vulnerable reset routine per the vendor note, though it should be treated as a side effect rather than a primary fix. The Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/bc656765-1eac-4a96-99e9-c22d64984923?source=cve) should be consulted for updated guidance.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-289 – Authentication Bypass by Alternate Name
View allShare
External POC / Exploit Code
Leaving vuln.today