Eventin WordPress Plugin CVE-2026-11821

Exploitation requires a valid WordPress account with at minimum subscriber-level access on the target site. The attacker must be authenticated (PR:L per CVSS); unauthenticated exploitation is not possible. The target site must have the Eventin plugin installed and active at a version ≤4.1.17. If subscriber-level registration is disabled and all accounts are trusted internal users, the exploitable attack surface is substantially reduced. No additional non-default configuration is required beyond plugin installation. The impact is limited to notification flow workflow management; it does not provide file system access, database access, or arbitrary code execution.

The CVSS 3.1 score of 5.4 (Medium) accurately reflects the constrained impact - an attacker can only manipulate notification automation workflows, not achieve code execution or access sensitive site data. CVSS PR:L confirms authenticated access is required, limiting the attacker pool to accounts with at minimum subscriber-level WordPress access. Attack complexity is low (AC:L), and no user interaction is needed. EPSS data is not provided; without KEV status or confirmed POC, real-world exploitation likelihood is moderate at best. The practical risk is primarily sabotage of event notification workflows (breaking automated emails) or intelligence gathering about internal automation configurations, rather than site takeover. This is a priority fix for multi-tenant WordPress environments (e.g., membership sites where subscriber accounts are externally registered) but is lower urgency on tightly controlled sites where subscriber registration is closed.

An attacker registers or obtains a subscriber-level WordPress account on a target site running Eventin ≤4.1.17. They then send authenticated REST API or AJAX requests to the FlowAPI endpoints, bypassing administrator-only authorization checks to enumerate, modify, or delete all notification automation workflows. No POC has been publicly identified, but the vulnerability is straightforward to discover from plugin source code inspection.