CVE-2026-9701 describes an authentication bypass vulnerability in the Eventer WordPress plugin (up to and including version 4.4.2). The plugin stores the password reset key in plaintext in the `eventer_verification_code` user meta field. An attacker who can retrieve this key can use the plugin's custom reset action to set a new password for any user account. This vulnerability is particularly severe when combined with other exploits like SQL Injection (CVE-2026-9700) that allow extraction of the plaintext reset key. The password reset function affected by this vulnerability only operates on PHP versions up to 7.4. There is no vendor advisory or patch information available at this time.

An attacker can bypass authentication by resetting passwords for arbitrary users, including administrators, leading to full account takeover. The vulnerability allows complete compromise of confidentiality, integrity, and availability of affected WordPress sites using the Eventer plugin on PHP <=7.4. The critical CVSS score of 9.8 reflects the high impact and ease of exploitation when combined with other vulnerabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the Eventer plugin or upgrading PHP beyond version 7.4 to mitigate the password reset function exploitation. Monitor vendor channels for updates and apply patches promptly once available.