CVE-2026-84905 Overview
CVE-2026-84905 affects the Eventin WordPress plugin in versions prior to 4.1.24. The plugin fails to verify a user's capability when adding a speaker, allowing authenticated users with contributor-level access or higher to create new WordPress user accounts. The created accounts carry capabilities beyond the original user, including publishing content and uploading files. An attacker who supplies a controlled email address obtains a functional login to the new account, effectively achieving vertical privilege escalation.
Critical Impact
Contributor-level authenticated users can create WordPress accounts with elevated capabilities and gain login access to those accounts by controlling the email address.
Affected Products
- Eventin WordPress plugin versions prior to 4.1.24
- WordPress sites permitting contributor-level registrations with Eventin installed
- Any site using vulnerable Eventin builds for event and speaker management
Discovery Timeline
- 2026-09-16 - CVE-2026-84905 published to the National Vulnerability Database (NVD)
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-84905
Vulnerability Analysis
The vulnerability is a missing authorization flaw classified under [CWE-862]. The Eventin plugin exposes a speaker creation function that provisions a WordPress user account as part of adding a speaker profile. The function does not check whether the calling user holds the create_users capability before executing the account creation logic.
An authenticated contributor can invoke this handler and specify the target account's role attributes. The created account receives capabilities the contributor does not possess, such as publish_posts and upload_files. Because the attacker supplies the email address bound to the new account, the standard WordPress password reset flow yields a working login.
Root Cause
The root cause is the absence of a current_user_can() capability check within the speaker registration handler. WordPress delegates authorization to plugin developers on custom endpoints. The Eventin handler validates authentication but does not validate authorization to create users, violating the principle of least privilege.
Attack Vector
The attack requires network access to the WordPress admin AJAX or REST endpoint and valid contributor-or-higher credentials. The attacker submits a crafted speaker creation request containing user account fields and an attacker-controlled email. After the account is created, the attacker triggers a password reset to obtain login credentials. See the WPScan Vulnerability Report for technical details on the vulnerable endpoint.
Detection Methods for CVE-2026-84905
Indicators of Compromise
- Unexpected WordPress user accounts created shortly after contributor logins or speaker submissions
- Password reset emails delivered to external or previously unseen email domains
- New accounts holding publish_posts or upload_files capabilities that did not originate from the standard admin registration flow
- Media library uploads or published posts authored by newly created accounts
Detection Strategies
- Audit the WordPress wp_users and wp_usermeta tables for accounts created outside standard onboarding workflows.
- Correlate Eventin speaker submission events with user_register action hook logs to identify unauthorized account provisioning.
- Review web server access logs for requests to Eventin speaker endpoints originating from contributor sessions.
Monitoring Recommendations
- Enable WordPress audit logging plugins to record user creation, role changes, and capability grants.
- Alert on password reset requests for accounts created within the previous 24 hours.
- Monitor outbound mail logs for reset emails delivered to domains not associated with the organization.
How to Mitigate CVE-2026-84905
Immediate Actions Required
- Update the Eventin plugin to version 4.1.24 or later on all WordPress installations.
- Review existing user accounts and remove any created by contributor-level users through the Eventin speaker workflow.
- Rotate credentials for accounts that may have been provisioned or accessed through this flaw.
Patch Information
The vendor addressed the issue in Eventin version 4.1.24 by adding the missing capability check to the speaker creation handler. Administrators should apply the update through the WordPress plugin manager or by downloading the fixed release from the official plugin repository. Refer to the WPScan Vulnerability Report for reference to the fixed version.
Workarounds
- Temporarily restrict contributor-level accounts on sites that cannot immediately update the plugin.
- Disable the Eventin plugin until the patched version is deployed.
- Enforce administrator approval workflows for any new user accounts created on the site.
# Update Eventin via WP-CLI to the patched release
wp plugin update wp-event-solution --version=4.1.24
# Verify the installed version
wp plugin get wp-event-solution --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.