{"id":"CVE-2026-84901","title":"The Eventin  WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event …","summary":"The Eventin  WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event …","severity":"medium","cvss":4.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-862"],"published":"2026-09-05","updated":"2026-09-08","sourceUpdated":"2026-09-08T19:09:21.310","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84901","references":[{"url":"https://wpscan.com/vulnerability/b1906fd4-82ab-435f-bb07-e8f2db402029/","label":"contact@wpscan.com"}],"tags":["nvd"],"epss":0.00193,"epssPercentile":0.09259,"ingestedAt":"2026-09-06T06:51:17.623Z","slug":"CVE-2026-84901","body":"## Overview\n\nThe Eventin  WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event and speaker taxonomy terms they should not be able to manage.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":27,"depthScoreParts":{"impact":27,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":8292,"id":"CVE-2026-84901","ts":1788919996127,"field":"cvss","old":null,"new":"4.9"},{"seq":8291,"id":"CVE-2026-84901","ts":1788919996127,"field":"severity","old":"none","new":"medium"},{"seq":8101,"id":"CVE-2026-84901","ts":1788919281709,"field":"cvss","old":"4.9","new":null},{"seq":8100,"id":"CVE-2026-84901","ts":1788919281709,"field":"severity","old":"medium","new":"none"},{"seq":7910,"id":"CVE-2026-84901","ts":1788916357345,"field":"cvss","old":null,"new":"4.9"},{"seq":7909,"id":"CVE-2026-84901","ts":1788916357345,"field":"severity","old":"none","new":"medium"},{"seq":7719,"id":"CVE-2026-84901","ts":1788915298874,"field":"cvss","old":"4.9","new":null},{"seq":7718,"id":"CVE-2026-84901","ts":1788915298874,"field":"severity","old":"medium","new":"none"},{"seq":7528,"id":"CVE-2026-84901","ts":1788912717859,"field":"cvss","old":null,"new":"4.9"},{"seq":7527,"id":"CVE-2026-84901","ts":1788912717859,"field":"severity","old":"none","new":"medium"},{"seq":7337,"id":"CVE-2026-84901","ts":1788911331907,"field":"cvss","old":"4.9","new":null},{"seq":7336,"id":"CVE-2026-84901","ts":1788911331907,"field":"severity","old":"medium","new":"none"},{"seq":7141,"id":"CVE-2026-84901","ts":1788909079467,"field":"cvss","old":null,"new":"4.9"},{"seq":7140,"id":"CVE-2026-84901","ts":1788909079467,"field":"severity","old":"none","new":"medium"},{"seq":6953,"id":"CVE-2026-84901","ts":1788907391962,"field":"cvss","old":"4.9","new":null},{"seq":6952,"id":"CVE-2026-84901","ts":1788907391962,"field":"severity","old":"medium","new":"none"},{"seq":6755,"id":"CVE-2026-84901","ts":1788905445325,"field":"cvss","old":null,"new":"4.9"},{"seq":6754,"id":"CVE-2026-84901","ts":1788905445325,"field":"severity","old":"none","new":"medium"},{"seq":6573,"id":"CVE-2026-84901","ts":1788903460182,"field":"cvss","old":"4.9","new":null},{"seq":6572,"id":"CVE-2026-84901","ts":1788903460182,"field":"severity","old":"medium","new":"none"},{"seq":6359,"id":"CVE-2026-84901","ts":1788901811373,"field":"cvss","old":null,"new":"4.9"},{"seq":6358,"id":"CVE-2026-84901","ts":1788901811373,"field":"severity","old":"none","new":"medium"},{"seq":6189,"id":"CVE-2026-84901","ts":1788899562549,"field":"cvss","old":"4.9","new":null},{"seq":6188,"id":"CVE-2026-84901","ts":1788899562549,"field":"severity","old":"medium","new":"none"},{"seq":6057,"id":"CVE-2026-84901","ts":1788898240572,"field":"cvss","old":null,"new":"4.9"},{"seq":6056,"id":"CVE-2026-84901","ts":1788898240572,"field":"severity","old":"none","new":"medium"}]}