The Eventer WordPress plugin stores a plaintext password reset key in the eventer_verification_code user meta field when a reset is requested. An attacker who can retrieve this key can invoke the plugin’s custom reset endpoint to set a new password for any user, including administrators. Combined with a separate SQL injection flaw, the reset key can be extracted directly from the database, allowing an unauthenticated attacker to seize any account.

WordPress sites that have the joe007 Eventer plugin at version 4.4.2 or earlier are affected. The flaw exists in every release up to and including 4.4.2 and is only usable with PHP version 7.4 or earlier, although the underlying issue remains regardless of PHP version. No other vendors or products are listed as impacted.

The CVSS score of 9.8 indicates a critical risk level. With an EPSS score of <1%, exploitation is unlikely but not impossible, especially where the unrelated CVE-2026-9700 SQL injection vulnerability can expose the reset key. The vulnerability is not part of the CISA KEV catalog, yet the public password-reset endpoint can be targeted on any WordPress site running a vulnerable Eventer plugin. Overall, the risk is high for sites that permit unauthenticated password resets with a vulnerable plugin.