CVE-2026-84905

The Eventin WordPress plugin before 4.1.24 fails to verify a user's capability to create accounts when adding a speaker. This allows any user with contributor-level access or above to create new WordPress user accounts that carry capabilities beyond their own, including publishing content and upl...