EUVD-2026-42163
GHSA-qhrf-5rv2-gph8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Full account takeover gives C/I/A High, but reliable exploitation needs a secondary key-disclosure flaw and PHP ≤7.4, so AC:H rather than the source vector's AC:L.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugin stores a plaintext copy of the password reset key in the eventer_verification_code user meta field when a user requests a password reset. The plaintext key stored in wp_usermeta can be used with the plugin's custom reset action to set a new password for any user. Combined with another vulnerability such as SQL Injection (CVE-2026-9700), this makes it possible for unauthenticated attackers to extract the plaintext reset key and take over any user account, including administrators. Note: The password reset function only works up to PHP version 7.4.
Articles & Coverage 2
AnalysisAI
Account takeover in the Eventer WordPress event-manager plugin (all versions through 4.4.2) stems from the plugin writing the password-reset key in cleartext to the eventer_verification_code field in wp_usermeta; any actor who can read that value can drive the plugin's custom reset action to set an arbitrary password for any user, including administrators. Chained with the companion SQL injection flaw CVE-2026-9700, remote attackers can extract the stored key without authentication and fully hijack accounts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) a target running Eventer 4.4.2 or earlier where a password reset has been or can be requested so that the plaintext key is written to the `eventer_verification_code` user_meta field, (2) a read primitive over the `wp_usermeta` table to recover that key - in the documented chain this is the SQL injection CVE-2026-9700 - and (3) the site running PHP 7.4 or earlier, because the plugin's reset function does not operate on PHP 8.x. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-style vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) reflects a best-case chained scenario: network, no privileges, no user interaction, full CIA loss via admin takeover. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | On a target WordPress site running Eventer 4.4.2 on PHP 7.4, an unauthenticated attacker triggers a password reset for the administrator account, then exploits the chained SQL injection (CVE-2026-9700) to read the plaintext `eventer_verification_code` value from `wp_usermeta`. Using that key with the plugin's custom reset action, the attacker sets a new admin password and logs in with full control. … |
| Remediation | No vendor-released patch identified at time of analysis - the description marks all versions through 4.4.2 as vulnerable and the references (Wordfence threat intel and the CodeCanyon listing) do not cite a fixed release, so administrators should monitor CodeCanyon for an update newer than 4.4.2 and apply it once published, then invalidate existing sessions and force a password reset for all accounts. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all WordPress instances running Eventer plugin versions 4.4.2 and earlier; enable WordPress audit logging for user account changes and logins. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-289 – Authentication Bypass by Alternate Name
View allShare
External POC / Exploit Code
Leaving vuln.today