CVE-2026-13174

Deferred Deferred - Pending Action

Unauthenticated User Account Deletion in Eventin WordPress Plugin

Publication date: 2026-08-19

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-26

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-13174

EUVD

EUVD-2026-62260

Affected Vendors & Products

Vendor	Product	Version / Range
eventin	eventin_wordpress_plugin	to 4.1.21 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

The Eventin WordPress plugin before version 4.1.21 has an Insecure Direct Object Reference (IDOR) flaw. This allows users with contributor-level access or higher to permanently delete other users' accounts without verifying ownership or proper capabilities.

Detection Guidance

Check the installed version of the Eventin WordPress plugin. If it is below 4.1.21, the system is vulnerable. Logs may show unauthorized user deletions by contributors or higher-level users.

Impact Analysis

An attacker with contributor-level access could delete other users' accounts, leading to data loss, disruption of services, or unauthorized removal of legitimate users from the WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized deletion of user data, potentially violating GDPR's data integrity requirements or HIPAA's access control mandates, depending on the context of the WordPress site.

Mitigation Strategies

Update the Eventin WordPress plugin to version 4.1.21 or later immediately. Review user accounts for unauthorized deletions and restrict contributor-level access to trusted users only.

Hi! I’m here to help you understand CVE-2026-13174. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70