CVE-2026-13174CWE-284broken-access-control

CVE-2026-13174

High · published August 19, 2026

CVSS v3.1
7.2
EPSS
0%
Percentile
39.1
In the wild
Unconfirmed
What it is

The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00462 · 39.1th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-08-19T10:17Z
References (1)
https://wpscan.com/vulnerability/849478d1-640f-49e0-8fa5-918e41654923/ · [email protected]
EPSS history
Timeline
  • 19 AUG 06:00Z
    Eventin < 4.1.21 - Contributor+ Speaker Account Deletion via IDOR
    cvelistv5