CVE-2026-13177
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Eventin WordPress plugin before version 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers.
Risk Assessment
Risk of customer privacy breach and personal data leakage, potentially leading to legal consequences and loss of trust.
Recommendation
Update the Eventin plugin to version 4.1.20 or later, which includes a fix restricting access to order records.
Original NVD description (English source)
The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers.