CVE-2026-84901 Overview
The Eventin WordPress plugin before version 4.1.22 contains a missing authorization vulnerability [CWE-862] in several event-management REST routes. Authenticated users with contributor-level access or higher can change the site's front-page setting to an event they do not own. The same flaw allows those users to create, edit, and delete global event and speaker taxonomy terms outside their assigned scope. The issue affects site integrity by enabling low-privileged accounts to manipulate content and configuration meant for administrators.
Critical Impact
Contributor-level accounts can hijack the front-page setting and tamper with global event and speaker taxonomies across the site.
Affected Products
- Eventin WordPress plugin versions before 4.1.22
Discovery Timeline
- 2026-09-05 - CVE-2026-84901 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-84901
Vulnerability Analysis
The Eventin plugin exposes REST API endpoints for managing events, speakers, and site settings. Several of these routes do not enforce ownership or capability checks appropriate to the action performed. Any authenticated user with the WordPress contributor role or higher can invoke them successfully. The vulnerability is classified as Missing Authorization under [CWE-862].
Exploitation produces two concrete outcomes. First, an attacker can overwrite the site's front-page setting so it points to an event the attacker does not own, effectively hijacking the homepage. Second, an attacker can create, modify, or delete global event and speaker taxonomy terms, corrupting shared metadata used across all events on the site.
Root Cause
The root cause is the absence of permission_callback logic that validates ownership and capability on the affected REST routes. WordPress REST controllers must return an authorization decision per request, but the affected endpoints accept any authenticated session that meets a low bar. Contributors, who are trusted to draft their own posts, gain access to actions reserved for editors and administrators.
Attack Vector
Exploitation requires an authenticated account at the contributor level or above. The attacker sends crafted HTTP requests to the vulnerable REST routes using their valid session nonce or application password. No user interaction from other users is required, and the attack occurs entirely over the network. See the WPScan Vulnerability Report for endpoint-level details.
Detection Methods for CVE-2026-84901
Indicators of Compromise
- Unexpected changes to the WordPress show_on_front or page_on_front options pointing to Eventin event content.
- Unauthorized creation, modification, or deletion of terms in the Eventin event category or speaker taxonomies.
- REST API requests to Eventin endpoints originating from accounts with the contributor role.
Detection Strategies
- Audit WordPress access logs for POST, PUT, and DELETE requests to /wp-json/ paths owned by the Eventin plugin from non-administrator accounts.
- Compare current front-page configuration against a known-good baseline and alert on drift.
- Review taxonomy term change history for entries created or modified by low-privileged users.
Monitoring Recommendations
- Enable WordPress audit logging for option changes, taxonomy operations, and REST API calls.
- Forward web server logs to a centralized analytics platform and alert on REST activity by contributor accounts.
- Track the installed version of the Eventin plugin across all WordPress sites in the estate.
How to Mitigate CVE-2026-84901
Immediate Actions Required
- Upgrade the Eventin plugin to version 4.1.22 or later on every affected WordPress site.
- Review contributor and author accounts and remove any that are not required.
- Reset the front-page setting and verify Eventin taxonomy terms match their expected values.
Patch Information
The vendor addressed this vulnerability in Eventin version 4.1.22 by adding authorization checks to the affected REST routes. Refer to the WPScan Vulnerability Report for advisory details and fix confirmation.
Workarounds
- Restrict access to /wp-json/ Eventin routes at the web application firewall for non-administrator users until the patch is applied.
- Temporarily downgrade contributor accounts or disable them where feasible.
- Disable the Eventin plugin on sites where the update cannot be deployed immediately.
# Update the Eventin plugin using WP-CLI
wp plugin update wp-event-solution --version=4.1.22
wp plugin list --name=wp-event-solution --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
