# CVE-2026-9701

## Summary

- **CVE ID:** CVE-2026-9701
- **Severity:** CRITICAL
- **CVSS Score:** 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **CWE:** CWE-289
- **Published:** Jul 8, 2026
- **Last Modified:** Jul 8, 2026

## Description

The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugin stores a plaintext copy of the password reset key in the `eventer_verification_code` user meta field when a user requests a password reset. The plaintext key stored in `wp_usermeta` can be used with the plugin's custom reset action to set a new password for any user. Combined with another vulnerability such as SQL Injection (CVE-2026-9700), this makes it possible for unauthenticated attackers to extract the plaintext reset key and take over any user account, including administrators. Note: The password reset function only works up to PHP version 7.4.

## Affected Products

- joe007 — Eventer (0)

## References

- [CNA](https://www.wordfence.com/threat-intel/vulnerabilities/id/bc656765-1eac-4a96-99e9-c22d64984923?source=cve)
- [CNA](https://codecanyon.net/item/eventer-wordpress-event-manager-plugin/20972534)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.48%
- **EPSS Percentile:** 39.9

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._