What the vulnerability does
01Description
The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugin stores a plaintext copy of the password reset key in the `eventer_verification_code` user meta field when a user requests a password reset. The plaintext key stored in `wp_usermeta` can be used with the plugin's custom reset action to set a new password for any user. Combined with another vulnerability such as SQL Injection (CVE-2026-9700), this makes it possible for unauthenticated attackers to extract the plaintext reset key and take over any user account, including administrators. Note: The password reset function only works up to PHP version 7.4.
Explanation of Vulnerability in Simple Terms
02Summary
Eventer versions up to 4.4.2 contain a critical authentication bypass vulnerability. An attacker can gain full control of the application without credentials, reading and modifying all data and disrupting service. The vulnerability requires only network access and no user interaction. Immediate patching is essential.
What an attacker can do
03Attacker Capabilities
Gain unauthorized access to the entire application and read, modify, or delete all data without authentication.
Potential impact on your site
04Site Impact
Complete compromise of the Eventer application and all data it manages; attackers can impersonate users and disrupt service.
Conditions required to exploit
05Prerequisites
Network access to the Eventer installation; no authentication or user interaction required.
Key dates
06Disclosure timeline
July 8, 2026
CVE published
July 8, 2026
Record updated
