Is CVE-2026-84901 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84901 being exploited in the wild.

How severe is CVE-2026-84901?

Medium severity, with a CVSS score of 4.9, published 5 September 2026.

Is there a fix for CVE-2026-84901?

A patch was published on 2026-09-05: Fixed in version 4.1.22 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84901 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-84901?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84901: WordPress Eventin plugin authorization bypass in REST routes

CVE-2026-84901 · Severity: medium · CVSS 4.9 · Published 2026-09-05

The Eventin WordPress plugin for event management fails to properly authorize REST API endpoints, allowing contributor-level users to hijack the website's homepage and manipulate event taxonomies they should not be able to edit. This could allow a low-privileged attacker to redirect all site visitors to an unauthorized event or inject unauthorized content into the event management system.

Quick answers

Is CVE-2026-84901 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84901 being exploited in the wild.
How severe is CVE-2026-84901?: Medium severity, with a CVSS score of 4.9, published 5 September 2026.
Which products and versions are affected?: Eventin Eventin before 4.1.22.
Is there a fix for CVE-2026-84901?: A patch was published on 2026-09-05: Fixed in version 4.1.22 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84901 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-84901?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing authorization (CWE-862) issue in Eventin's REST API endpoints for event management. Affected routes include the homepage-setting endpoint and taxonomy manipulation endpoints for event categories, tags, and speaker categories. An attacker with contributor-level access (requires valid WordPress account) can craft authenticated REST requests with a valid nonce to modify the site's front-page setting to point to events they do not own, and create/edit/delete global event and speaker taxonomy terms without the required capabilities. The attack requires authentication but no additional user interaction. The vulnerability was fixed in version 4.1.22.

Affected products

Eventin Eventin before 4.1.22

Timeline

2026-09-03: disclosed
2026-09-05: patched: Fixed in version 4.1.22

References

https://wpscan.com/vulnerability/b1906fd4-82ab-435f-bb07-e8f2db402029/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.