WordPress Plugin Vulnerabilities

Eventin < 4.1.21 - Contributor+ Speaker Account Deletion via IDOR

Description

The plugin does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts.

Proof of Concept

Affects Plugins

Plugin icon
wp-event-solution
Fixed in 4.1.21

References

CVE
CVE-2026-13174

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
Muni Nitish Kumar Yaddala
Submitter
Muni Nitish Kumar Yaddala
Verified
Yes
WPVDB ID
849478d1-640f-49e0-8fa5-918e41654923

Timeline

Publicly Published
2026-08-17 (about 3 days ago)
Added
2026-08-17 (about 2 days ago)
Last Updated
2026-08-17 (about 2 days ago)

Other

Published
Title
Published
2024-05-01
Title
Contact Form by WPForms – Drag & Drop Form Builder for WordPress < 1.8.8.2 - Unauthenticated Price Manipulation
Published
2022-05-18
Title
Jupiter < 6.10.2 - Subscriber+ Arbitrary Plugin Deletion
Published
2021-10-19
Title
Download Plugin < 1.6.1 - Subscriber+ Arbitrary Plugin Activation
Published
2021-10-18
Title
Insert Pages < 3.7.0 - Contributor+ Arbitrary Posts/Pages Access
Published
2020-10-16
Title
TI WooCommerce Wishlist - Authenticated WP Options Change