Eventin CVE-2026-13169

Exploitation requires an active WordPress account with at minimum contributor-level role on the target site running Eventin before version 4.1.21. The attacker must be able to authenticate to the WordPress site and submit HTTP requests to the Eventin plugin's event management endpoints. No special network position, additional misconfiguration, or victim interaction is required beyond possessing a contributor account. Exploitation is constrained by: (1) authentication - unauthenticated visitors cannot exploit this flaw; (2) account availability - the attacker must have or obtain a contributor-or-higher WordPress account on the specific target site; (3) plugin version - sites running Eventin 4.1.21 or later are not affected. Sites where all contributor accounts belong to fully trusted internal staff face negligible realistic risk despite the technical severity.

The NVD CVSS base score of 8.1 (High) is driven by low attack complexity, network accessibility, and high confidentiality and integrity impact ratings. The single most important risk-limiting factor is PR:L - exploitation is bounded to users holding at minimum a contributor WordPress account, which excludes unauthenticated external attackers and significantly narrows the realistic threat population to insider threats or compromised low-privilege accounts. The provided CVSS vector rates A:N (no availability impact), which appears inconsistent with the described ability to delete events outright; defenders should treat availability as at least partially impacted and this analysis adjusts accordingly. No EPSS score was included in the available intelligence, so probabilistic exploitation likelihood cannot be quantified numerically. The vulnerability is absent from the CISA KEV catalog, meaning active exploitation is not confirmed. Risk is highest for multi-author WordPress sites - event agencies, conference organizers, membership platforms - where external or untrusted users hold contributor accounts. Single-author sites or closed contributor pools face negligible realistic risk.

An attacker authenticates to a target WordPress site using a legitimately obtained or compromised contributor account, then sends event modification or deletion API requests while cycling through sequential event IDs. When an administrator-owned event ID is hit, the plugin processes the operation without verifying ownership, allowing the attacker to overwrite event content with malicious links, delete upcoming events to cause disruption, or reassign authorship to their own account. No public proof-of-concept has been identified, but the IDOR pattern requires only basic HTTP request manipulation and is well within the capability of any attacker with contributor credentials.