CVE-2026-84901 Eventin CVE debrief

Who should care

WordPress administrators, security teams, and developers who use the Eventin plugin should assess their exposure and prioritize remediation. This includes operators managing WordPress installations with the Eventin plugin, as well as vulnerability management and security teams responsible for ensuring the security of these installations. Additionally, developers who use the Eventin plugin in their projects should also be aware of this vulnerability and take necessary steps to protect their applications. They should verify the version of the Eventin WordPress plugin and update to 4.1.22 or later if necessary, restrict access to the WordPress installation's REST routes, and monitor the WordPress installation for suspicious activity related to event management and taxonomy terms. Furthermore, defenders should consider the potential impact on their organization's security posture and take proactive measures to mitigate the risk associated with this vulnerability. This may involve reviewing compensating controls, conducting asset inventories, and establishing rollback change windows as needed. By taking these steps, defenders can help prevent exploitation of this vulnerability and protect their WordPress installations from potential attacks. The remediation priority is medium due to the CVSS score of 4.9 and MEDIUM severity, and defenders should prioritize verifying and remediating this vulnerability in their WordPress installations, especially those with multiple contributors or users with elevated access. To ensure thorough protection, defenders should also track exceptions, retest remediated assets, and close the item only after evidence is documented, verifying that the updated plugin version is properly configured and that access controls are in place to prevent unauthorized changes to the site's front-page setting and global event and speaker taxonomy terms. Effective communication and coordination between operators, developers, and security teams are crucial to ensure that all stakeholders are aware of the vulnerability and are working together to mitigate its impact. By prioritizing remediation and taking proactive measures, defenders can minimize the risk of

Why it matters

CVE-2026-84901 is a MEDIUM-severity vulnerability in the Eventin WordPress plugin that allows users with contributor-level access to bypass authorization and make unauthorized changes to the site's front-page setting and global event and speaker taxonomy terms. WordPress administrators and security teams should assess their exposure and prioritize remediation.

• An attacker with contributor-level access could change the site's front-page setting to an event they do not own, potentially leading to unauthorized content display.
• An attacker could create, edit, and delete global event and speaker taxonomy terms, affecting the site's content and structure.
• Defenders should verify the version of the Eventin WordPress plugin and update to 4.1.22 or later to prevent exploitation.
• Remediation priority is medium due to the CVSS score of 4.9 and MEDIUM severity.

Technical summary

The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event and speaker taxonomy terms they should not be able to manage. This vulnerability has a CVSS score of 4.9 and MEDIUM severity.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their WordPress installations, especially those with multiple contributors or users with elevated access.

Recommended defensive actions

• Verify the version of the Eventin WordPress plugin and update to 4.1.22 or later if necessary.
• Restrict access to the WordPress installation's REST routes to prevent unauthorized changes.
• Monitor the WordPress installation for suspicious activity related to event management and taxonomy terms.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 4.9 and MEDIUM severity. A source reference from WPScan is also available. The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event and speaker taxonomy terms they should not be able to manage. To verify and remediate this vulnerability, defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.