CVE-2026-13171
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The Eventin WordPress plugin before version 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records.
Risk Assessment
Risk of unauthorized account creation and order data manipulation, potentially leading to spam, fraud, and data integrity issues.
Recommendation
Update the Eventin plugin to version 4.1.20 or later, which includes a fix adding authorization checks to the waiting-list handler.
Original NVD description (English source)
The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records.