CVE-2026-84905: CWE-862 Missing Authorization in Eventin
The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and above to create new WordPress user accounts that carry capabilities beyond their own, including publishing content and uploading files, and, by supplying an email address they control, to obtain a working login to the created account.
AI Analysis
Technical Summary
CVE-2026-84905 is a missing authorization vulnerability (CWE-862) in the Eventin WordPress plugin versions prior to 4.1.24. The plugin does not verify whether a user has the appropriate capability to create accounts when adding a speaker. Consequently, users with contributor-level access or above can create new WordPress user accounts that inherit capabilities beyond their privileges, including publishing content and uploading files. Attackers can supply an email address they control to receive working login credentials for these accounts.
Potential Impact
Attackers with contributor-level access or higher can escalate privileges by creating new user accounts with elevated capabilities. This can lead to unauthorized content publication, file uploads, and persistence within the WordPress environment. The vulnerability enables privilege escalation and unauthorized access through account creation without proper authorization checks.
Mitigation Recommendations
Upgrade the Eventin plugin to version 4.1.24 or later, where this authorization issue has been fixed. Until the update is applied, restrict contributor-level access to trusted users only. No official patch link is provided in the input, but the version 4.1.24 is indicated as the fixed version.
CVE-2026-84905: CWE-862 Missing Authorization in Eventin
Description
The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and above to create new WordPress user accounts that carry capabilities beyond their own, including publishing content and uploading files, and, by supplying an email address they control, to obtain a working login to the created account.
Affected software
Eventin
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-84905 is a missing authorization vulnerability (CWE-862) in the Eventin WordPress plugin versions prior to 4.1.24. The plugin does not verify whether a user has the appropriate capability to create accounts when adding a speaker. Consequently, users with contributor-level access or above can create new WordPress user accounts that inherit capabilities beyond their privileges, including publishing content and uploading files. Attackers can supply an email address they control to receive working login credentials for these accounts.
Potential Impact
Attackers with contributor-level access or higher can escalate privileges by creating new user accounts with elevated capabilities. This can lead to unauthorized content publication, file uploads, and persistence within the WordPress environment. The vulnerability enables privilege escalation and unauthorized access through account creation without proper authorization checks.
Mitigation Recommendations
Upgrade the Eventin plugin to version 4.1.24 or later, where this authorization issue has been fixed. Until the update is applied, restrict contributor-level access to trusted users only. No official patch link is provided in the input, but the version 4.1.24 is indicated as the fixed version.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-02T15:31:30.838Z
- State
- PUBLISHED
Threat ID: 6aaa32e055bf5e2cf517fb31
Added to database: 09/16/2026, 06:10:40 UTC
Last enriched: 09/16/2026, 06:31:30 UTC
Last updated: 09/16/2026, 22:11:12 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.