CVE-2026-9701

The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugin stores a plaintext copy of the password reset key in the `eventer_verification_code` user meta field when a user requests a password reset. The plaintext key stored in `wp_usermeta` can be used with the plugin's custom reset action to set a new password for any user. Combined with another vulnerability such as SQL Injection (CVE-2026-9700), this makes it possible for unauthenticated attackers to extract the plaintext reset key and take over any user account, including administrators. Note: The password reset function only works up to PHP version 7.4.

• CWE-289

• https://codecanyon.net/item/eventer-wordpress-event-manager-plugin/20972534
• https://www.wordfence.com/threat-intel/vulnerabilities/id/bc656765-1eac-4a96-99e9-c22d64984923?source=cve

Published

Jul 8, 2026

Last Modified

Jul 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-97004Heap-based buffer overflow in Microsoft Office Excel allows …8.8
• CVE-2026-97005Out-of-bounds read in Microsoft Office PowerPoint allows an …5.5
• CVE-2026-97006Out-of-bounds read in Windows DNS allows an authorized attac…4.9
• CVE-2026-97007Heap-based buffer overflow in Microsoft Office Excel allows …8.8
• CVE-2026-97008Buffer underwrite ('buffer underflow') in Microsoft Office E…8.8
• CVE-2026-97009Heap-based buffer overflow in Microsoft Office Excel allows …7.8
• CVE-2026-97010Use after free in Microsoft Office Excel allows an unauthori…8.8
• CVE-2026-97011Use of uninitialized resource in Microsoft Office Excel allo…8.8
• CVE-2026-97012Stack-based buffer overflow in Microsoft Office Outlook allo…8.8
• CVE-2026-97013Access of resource using incompatible type ('type confusion'…7.8
• CVE-2026-97014Out-of-bounds read in Microsoft Office Excel allows an unaut…5.5
• CVE-2026-97015Heap-based buffer overflow in Windows BitLocker allows an un…6.8