CVE-2026-13174

The Eventin WordPress plugin prior to version 4.1.21 is vulnerable as it fails to verify user ownership or permissions before allowing account deletions. This flaw enables users with contributor-level access and higher to permanently remove other users' accounts, potentially leading to unauthorized data loss and disruption of services. WordPress site administrators and developers utilizing this plugin should prioritize updating to the latest version to mitigate this risk.