WordPress Eventin plugin < 4.1.20 - Unauthenticated Account Creation via Waiting List Endpoint vulnerability

Unauthenticated Account Creation via Waiting List Endpoint vulnerability discovered by Sanjorn Keeratirungsan in WordPress Plugin WP Event SOlution versions 4.1.20...

CVE-2026-13171

The Eventin (also referred to as WP Event Solution ) WordPress plugin, in versions prior to 4.1.20 , is vulnerable to an improper access control flaw. The plugin fails to perform an authorization check on its waiting-list registration handler . This allows unauthenticated users to successfully cr...