CVE-2026-13173

The Eventin WordPress plugin (before 4.1.21) lacks permission checks during speaker creation, letting contributor-level users modify other users' roles and metadata. WPScan documents the issue; upgrading to 4.1.21 or later resolves it. No in-the-wild exploitation is reported in the provided docum...