Eventin CVE-2026-13174

Exploitation requires an authenticated WordPress session with at minimum contributor-level role assignment on the target site. The contributor role is a standard, non-default WordPress role that site owners must explicitly grant, but is commonly assigned on multi-author blogs, community portals, and event-driven sites that use Eventin for its intended purpose. No special server-side configuration, non-default plugin setting, or specific PHP version is required beyond having the vulnerable Eventin plugin installed and active. Exploitation is limited to the scope of the affected WordPress installation - attackers cannot leverage this to pivot to the underlying server or other applications. The target user's ID must be known or guessable; WordPress user IDs are typically sequential integers and can often be inferred or enumerated via the WordPress REST API if user enumeration is not disabled.

The NVD-assigned CVSS vector specifies PR:H (high privileges required), yet the vulnerability description explicitly states that contributor-level WordPress access - a role routinely granted to guest bloggers, event volunteers, and temporary staff - is sufficient for exploitation. This is a material discrepancy: contributor maps more accurately to PR:L than PR:H, and defenders who rely solely on the headline CVSS vector may underestimate the realistic attacker population on multi-author sites. No EPSS score was provided, and no CISA KEV listing exists, so quantified exploitation probability cannot be stated with confidence; absence from KEV does not imply low risk given the trivial technical barrier. Even a mid-sized municipal IT team in sanok running a community event portal on Eventin should treat this as urgent, since a single disgruntled contributor account could irreversibly delete administrator or editor accounts, disrupting the site's operational continuity. The S:U scope and lack of a network privilege escalation path cap the blast radius to within the WordPress installation itself, but permanent account deletion is a high-impact action that may be difficult to recover from without database backups. No public exploit code has been identified, which moderates the immediate threat window, but the simplicity of the missing check means a functional exploit requires minimal skill to construct.

An attacker who has registered or obtained contributor-level credentials on a target WordPress site running Eventin before 4.1.21 submits a crafted HTTP request to the plugin's account-deletion endpoint, supplying the user ID of an administrator or other privileged account. Because the plugin performs no capability or ownership check, the request is processed and the target account is permanently deleted - potentially locking out site administrators. No public exploit code has been identified, but the attack requires only knowledge of the endpoint and a valid target user ID, both of which are low-effort to obtain on typical WordPress installations.