CVE-2026-84901

4.9 Moyenne

Publiée le 05/09/2026 à 09:17 · Modifiée le 08/09/2026 à 21:09 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event and speaker taxonomy terms they should not be able to manage.

Traduire en français

Produits concernés

Unknown Eventin

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.9 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N`

Faiblesses (CWE)

CWE-862

Références

https://wpscan.com/vulnerability/b1906fd4-82ab-435f-bb07-e8f2db402029/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories