The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creation, allowing users with contributor-level access and above to modify other users' roles and metadata.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 19 Aug 2026 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creation, allowing users with contributor-level access and above to modify other users' roles and metadata. | |
| Title | Eventin < 4.1.21 - Contributor+ User Role and Meta Modification via Speaker Creation | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-08-19T06:00:14.418Z
Reserved: 2026-06-24T13:24:41.332Z
Link: CVE-2026-13173
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-19T06:17:31.960
Modified: 2026-08-19T06:17:31.960
Link: CVE-2026-13173
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.