·9 min read
When || becomes a vulnerability: CVE-2026-40776 in WordPress Eventin
How a public REST endpoint dispensing wp_rest nonces, plus a single || operator in three permission callbacks, collapsed authorization for 10,000+ WordPress sites running the Eventin plugin.
CVE-2026-40776
CVSS 7.5 · HIGH
CWE-862