CVE-2026-84901— Eventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization
Quick assessment
Affected
Unknown Eventin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Eventin WordPress 插件在 4.1.22 版本之前，未对其事件管理相关的多个 REST API 路由进行适当的权限校验。这使得拥有“贡献者”（Contributor）及以上权限的用户能够： 1. 将网站的前端主页设置修改为一个他们并不拥有的事件； 2. 创建、编辑和删除全局的事件（event）和演讲者（speaker）分类法术语（taxonomy terms），而按照权限设计，这些用户本不应有权管理这些内容。
Possible ATT&CK Techniques 3 AI
T1059 · Command and Scripting Interpreter T1078 · Valid Accounts T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-84901
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Eventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization
Source: CVE Program / CVE List V5
Vulnerability Description
The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event and speaker taxonomy terms they should not be able to manage.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-84901
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-84901
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-84901 (1)
-
🔗 Eventin < 4.1.22 – Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization | CVE 2026-84901 | Plugin Vulnerabilities exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-05 · 34 CVEs total
| CVE-2026-77826 | RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Fa | |
| CVE-2026-82304 | Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-data Handler | |
| CVE-2026-81424 | Accept Stripe Payments < 2.1.4 - Unauthenticated Product Substitution via IDOR | |
| CVE-2026-83543 | Greenshift < 13.2.0 - Contributor+ SSRF via get-csv-to-json REST Endpoint | |
| CVE-2026-83544 | Greenshift < 13.2.0 - Contributor+ Stored XSS via Block Animation customProps Attribute | |
| CVE-2026-81423 | Accept Stripe Payments < 2.1.4 - Open Redirect via IPN Handler | |
| CVE-2026-81348 | My Private Site < 4.2.3 - Unauthenticated Sensitive Information Exposure via RSS Feeds and | |
| CVE-2026-81404 | IPGP Visitors Origin < 1.6 - Reflected XSS | |
| CVE-2026-78362 | SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation via API Key Au | |
| CVE-2026-82846 | Masteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom Fields | |
| CVE-2026-78149 | Post Carousel 4.0.0 - 4.0.7 - Unauthenticated Password-Protected Post Content and post_pas | |
| CVE-2026-78150 | Post Carousel 4.0.0 - 4.0.7 - Contributor+ Private and Protected Post Content Disclosure v | |
| CVE-2026-19861 | JetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WYSIWYG Field in Notification Em | |
| CVE-2026-15247 | Search Atlas SEO < 2.6.24 - Subscriber+ Google Service Account Credential Overwrite/Deleti | |
| CVE-2026-19858 | JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure | |
| CVE-2025-15694 | Joli Table Of Contents 2.0.0 - 2.8.0 - Admin+ Stored XSS | |
| CVE-2025-15693 | JCH Optimize 4.2.1 - 5.0.0 - Admin+ Path Traversal | |
| CVE-2026-84937 | YT Player < 2.1.0 - Contributor+ SQLi via ytp_ajax | |
| CVE-2026-84021 | Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_ | |
| CVE-2026-84022 | Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element Attribu |
Showing top 20 of 34 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Eventin
-
CVE-2026-84906
Eventin < 4.1.24 - Unauthenticated Payment Bypass via Stripe -
CVE-2026-84907
Eventin < 4.1.24 - Unauthenticated Order and Attendee Status -
CVE-2026-84905
Eventin < 4.1.24 - Contributor+ User Creation via Speaker Cr -
CVE-2026-77702
Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via -
CVE-2026-84898
Eventin < 4.1.21 - Contributor+ LFI via Event Layout Meta
Same vendor: Unknown
-
CVE-2026-87831
Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attac -
CVE-2026-87829
Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attac -
CVE-2026-91017
Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthen -
CVE-2026-86801
To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, Fi -
CVE-2026-87963
Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username
V. Comments for CVE-2026-84901
No comments yet