CVE-2026-9701

The record

The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugin stores a plaintext copy of the password reset key in the `eventer_verification_code` user meta field when a user requests a password reset. The plaintext key stored in `wp_usermeta` can be used with the plugin's custom reset action to set a new password for any user. Combined with another vulnerability such as SQL Injection (CVE-2026-9700), this makes it possible for unauthenticated attackers to extract the plaintext reset key and take over any user account, including administrators. Note: The password reset function only works up to PHP version 7.4.

Affected packages

Related vulnerabilities

• CVE-2026-15980 The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all… CWE-289
• CVE-2026-32639 Winter CMS is a content management system built on the Laravel PHP framework. CWE-289
• CVE-2026-15985 The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to… CWE-289
• CVE-2026-55075 Coder allows organizations to provision remote development environments via Terraform. CWE-289
• CVE-2026-56091 When using Apache Shiro with the shiro-guice module in a web servlet context, a specially… CWE-289
• CVE-2026-53622 Traefik is an HTTP reverse proxy and load balancer. CWE-289
• CVE-2026-50627 The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience)… CWE-289
• CVE-2026-44492 Axios is a promise based HTTP client for the browser and Node.js. CWE-289