Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-9701: WordPress Eventer Plugin <= 4.4.2 - Unauthenticated User Account Takeover
CVE-2026-9701
CVE-2026-9701
Summary
The Eventer plugin for WordPress stores password reset keys in plain text, making it possible for attackers to reset any user's password without needing a password. This is especially concerning because it allows an attacker to take control of administrator accounts. To protect your site, update the Eventer plugin to the latest version and consider limiting access to sensitive functions like password resets.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| joe007 | eventer | <= 4.4.2 |
Original title
The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugin stores a plaintext copy of the password reset key in t...
Original description
The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugin stores a plaintext copy of the password reset key in the `eventer_verification_code` user meta field when a user requests a password reset. The plaintext key stored in `wp_usermeta` can be used with the plugin's custom reset action to set a new password for any user. Combined with another vulnerability such as SQL Injection (CVE-2026-9700), this makes it possible for unauthenticated attackers to extract the plaintext reset key and take over any user account, including administrators. Note: The password reset function only works up to PHP version 7.4.
mitre CVSS3.1
9.8
Vulnerability type
CWE-289
Published: 8 Jul 2026 · Updated: 20 Jul 2026 · First seen: 8 Jul 2026