Eventin WordPress Plugin CVE-2026-13171

The target WordPress site must be running the Eventin plugin in a version prior to 4.1.20, with at least one event configured to use the waiting-list feature (this is a standard, not non-default, plugin capability). The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no special conditions - remote unauthenticated exploitation against default configurations of the Eventin plugin. No authentication, elevated privileges, or specific server configuration is required. The primary limiting factor is that the Eventin plugin must be installed and active on the target site; exploitation is further constrained by whether the attacker can enumerate valid admin or user email addresses to maximize impact beyond noise-level account creation.

The CVSS 8.2 High score reflects a fully remote, zero-complexity, unauthenticated (AV:N/AC:L/PR:N/UI:N) attack path with high integrity impact - a combination that warrants immediate attention. The EPSS score of 15% is substantially above the median for CVEs and, combined with confirmed publicly available exploit code from WPScan, indicates a non-negligible probability of opportunistic exploitation in the near term. The Scope:Unchanged (S:U) rating likely understates cascading risk: an attacker who creates a WordPress account for a victim's email address can then exploit the native forgot-password flow to gain authenticated access, potentially escalating to full site compromise depending on the assigned role. No CISA KEV listing is present at time of analysis, so confirmed widespread active exploitation is not established, but the low attack complexity and public exploit make scripted mass scanning highly plausible. The low confidentiality impact (C:L) reflects secondary exposure through account enumeration rather than direct data leakage.

An attacker sends a crafted unauthenticated HTTP POST request to the Eventin waiting-list handler, supplying a target victim's email address (e.g., a site administrator) as the registrant; the plugin creates a WordPress user account for that email without any authorization check. The attacker then triggers WordPress's native password reset for the newly created account, delivering a reset link to the victim's inbox - or, if the attacker controls the email address, directly sets a password and logs in. A publicly available exploit from WPScan lowers the barrier to fully automated, multi-site exploitation.