CVE-2026-84905 in Eventin Plugin
Summary
by MITRE • 09/16/2026
The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and above to create new WordPress user accounts that carry capabilities beyond their own, including publishing content and uploading files, and, by supplying an email address they control, to obtain a working login to the created account.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in Eventin versions prior to 4.1.24 represents a critical authorization flaw within the WordPress plugin ecosystem, specifically affecting the mechanism for adding speakers to events. This issue stems from an improper implementation of access control checks during the user creation process. When an administrator or editor utilizes the speaker addition feature, the application fails to validate whether the initiating user possesses the necessary privileges to assign elevated capabilities to newly created accounts. Consequently, this logic error allows users with contributor-level permissions and higher to bypass standard security boundaries intended for their role level.
From a technical perspective, the core deficiency lies in the absence of capability verification when instantiating new WordPress user objects through the plugin's interface. In a secure implementation, any action that results in the creation of an account or modification of existing privileges must strictly enforce Role-Based Access Control (RBAC) policies defined by the platform. Here, the system accepts input from lower-privileged users and processes it to generate accounts with administrative-level capabilities such as publishing content without restriction and uploading files directly to the media library. This behavior contradicts the principle of least privilege, which dictates that a user should only have access to resources necessary for their specific function.
The operational impact of this vulnerability is severe due to its potential for privilege escalation. An attacker with contributor-level access can exploit this flaw to create new WordPress accounts where they control both the username and password via email verification. By supplying an email address under their control, the attacker secures persistent login credentials for these newly minted high-privilege accounts. This effectively grants them administrative rights without needing to compromise existing administrator passwords or exploit other system weaknesses. The ability to publish content allows for defacement or injection of malicious scripts into public-facing pages, while file upload capabilities enable the hosting of web shells or phishing materials on the compromised server infrastructure.
This vulnerability aligns with CWE-269, which describes Improper Privilege Assignment, as it involves granting users more permissions than they are entitled to hold. Furthermore, in terms of offensive security frameworks like MITRE ATT&CK, this behavior maps closely to T1078 Valid Accounts and specifically the subtechnique for Default Accounts if default credentials were involved, but primarily reflects unauthorized privilege escalation through application logic flaws. It also touches upon CWE-284 Improper Access Control because the system fails to properly restrict access rights based on user roles during a critical administrative operation.
Mitigation strategies must prioritize immediate software updates and robust input validation practices. The most effective remediation is upgrading Eventin to version 4.1.24 or later, where this authorization check has been corrected by the developers. For environments unable to update immediately due to compatibility constraints, administrators should implement strict role management policies, ensuring that only users with explicit administrator privileges can manage user accounts and speaker lists. Additionally, deploying a Web Application Firewall (WAF) with rules targeting suspicious patterns in user creation endpoints may provide an additional layer of defense by blocking requests that attempt to set elevated capabilities for non-administrative roles. Regular auditing of WordPress user permissions and monitoring for unusual account creations are also recommended defensive measures to detect exploitation attempts early.