CVE-2026-84901 — Eventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization

CVE-2026-84901

Eventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization PUBLISHED

Description (CNA)

The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event and speaker taxonomy terms they should not be able to manage.

Affected (CNA)

Vendor / product	Versions
Unknown / Eventin	affected 0 before 4.1.22

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/b1906fd4-82ab-435f-bb07-e8f2db402029/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.