Eventin WordPress Plugin CVE-2026-13168

Exploitation requires a valid WordPress account with at minimum contributor-level access on the target site - PR:L in the CVSS vector confirms this authentication prerequisite, and unauthenticated exploitation is not possible. The vulnerable behavior is specific to the Eventin plugin's customer record storage and retrieval functionality; sites not running Eventin are unaffected. The attack is not automatable per SSVC, meaning large-scale cross-site exploitation campaigns are not straightforward. Sites that disable open user registration and grant contributor access only to vetted internal staff face substantially reduced real-world risk. All Eventin installations on versions prior to 4.1.20 where contributor or higher roles exist are within scope, regardless of other WordPress configuration.

The CVSS 6.5 score reflects a medium-severity finding with high confidentiality impact (C:H) but no integrity or availability dimensions, and the network attack vector combined with low privilege requirement (PR:L) creates a meaningful exposure surface in multi-user WordPress environments. The EPSS score of 15% is notably elevated for a medium-CVSS finding and signals real-world exploitation interest above baseline. A publicly available proof-of-concept exists, confirmed by WPScan's exploit-tagged reference, though the SSVC assessment qualifies this further: exploitation is not automatable (Automatable: no) and technical impact is partial, limiting the potential for bulk cross-site scanning attacks. The vulnerability is absent from the CISA KEV catalog, so widespread confirmed exploitation is not established. Even a mid-sized municipal IT team in leszno running a community events WordPress site should treat this as a priority patch given contributor accounts are often provisioned for external parties. The combination of available POC code, elevated EPSS, and low authentication barrier makes this a credible near-term risk wherever untrusted or semi-trusted users hold contributor roles on Eventin-powered sites.

An attacker who holds or obtains a contributor-level WordPress account on a site running Eventin before 4.1.20 sends crafted HTTP requests to the plugin's customer record endpoint without administrative credentials. Because the plugin fails to enforce a capability check, the server returns full customer records including names and email addresses belonging to other registrants. A public proof-of-concept lowers the technical barrier significantly, making this accessible to low-skill attackers with any level of WordPress account access.