What is GHSA-mc5w-3m87-prj3?

GHSA-mc5w-3m87-prj3 is a security advisory published by GitHub Security Advisories with Low severity. The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create...

Which CVE IDs does GHSA-mc5w-3m87-prj3 cover?

GHSA-mc5w-3m87-prj3 covers the following CVE IDs: CVE-2026-84905. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mc5w-3m87-prj3?

GHSA-mc5w-3m87-prj3 has a CVSS v3 base score of 2.7, published by GitHub Security Advisories.

GHSA-mc5w-3m87-prj3LowCVSS 2.7

The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create...

Vendor

GitHub Security Advisories

Published

September 16, 2026

Last Modified

September 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-84905 →

📋 Description

The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and above to create new WordPress user accounts that carry capabilities beyond their own, including publishing content and uploading files, and, by supplying an email address they control, to obtain a working login to the created account.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-84905
https://wpscan.com/vulnerability/6d3bfda2-351a-4700-9fd4-4c3101bfcd38
https://github.com/advisories/GHSA-mc5w-3m87-prj3