CVE-2026-84901

The Eventin WordPress plugin (a.k.a. WP Event Solution) versions before 4.1.22 lack proper authorization checks on several event-management REST routes. Users with contributor-level access or above can change the site's front-page setting to an event they do not own and create, edit, or delete gl...