CVE-2026-13170
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
The Eventin WordPress plugin before version 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with editor-level access and above to include and execute arbitrary local PHP files.
Risk Assessment
Users with editor privileges could execute arbitrary PHP code on the server, leading to full compromise of the system and data.
Recommendation
Update the Eventin plugin to version 4.1.20 or later, which includes path validation fixes.
Other vulnerabilities in Eventin WordPress plugin
See all- CVE-2026-13175Medium
The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users.
- CVE-2026-13174High
The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts.
- CVE-2026-13173Low
The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creation, allowing users with contributor-level access and above to modify other users' roles and metadata.
- CVE-2026-13169High
The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including administrators.
Original NVD description (English source)
The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with editor-level access and above to include and execute arbitrary local PHP files.