CVE-2026-9701 describes an authentication bypass vulnerability in the Eventer WordPress plugin (versions up to and including 4.4.2). The plugin insecurely stores the password reset key in plaintext in the `eventer_verification_code` user meta field. An attacker who can obtain this key, potentially via another vulnerability like SQL Injection (CVE-2026-9700), can use the plugin's custom reset action to set a new password for any user account. This issue affects the password reset functionality only on PHP versions up to 7.4.

Successful exploitation allows unauthenticated attackers to reset passwords for any user, including administrators, leading to full account takeover. This compromises confidentiality, integrity, and availability of the affected WordPress site. The vulnerability is critical with a CVSS score of 9.8, indicating high impact and ease of exploitation over the network without privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the Eventer plugin's password reset functionality or upgrading PHP beyond version 7.4 if feasible, as the vulnerable reset function only operates on PHP 7.4 and earlier. Monitor vendor channels for updates and patches addressing this vulnerability.