CVE-2026-13168
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The Eventin WordPress plugin before version 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses.
Risk Assessment
Risk of privacy breach and leakage of customer personal data, potentially leading to GDPR violations and loss of trust.
Recommendation
Update the Eventin plugin to version 4.1.20 or later, which includes a fix restricting access to customer records.
Original NVD description (English source)
The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses.