EUVD-2026-63907
GHSA-v7v5-h6rx-g9vq
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Contributor is a low-privileged WordPress role making PR:L more accurate than official PR:H; blind SSRF yields only limited confidentiality impact with no integrity or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts.
AnalysisAI
Blind server-side request forgery in the Eventin WordPress plugin prior to version 4.1.21 allows contributor-level authenticated users to direct the WordPress server to issue arbitrary outbound HTTP requests by supplying unvalidated webhook URLs on events they do not own. Two distinct control failures compound the issue: webhook URL input is accepted without sanitization, and the plugin performs no event ownership check, meaning any contributor can abuse another user's event configuration. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires at minimum a valid contributor-level WordPress account on the target installation - contributor is an authenticated but low-privileged role, above subscriber and below author, editor, and administrator. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official NVD CVSS score of 2.7 (Low) is derived from a PR:H vector, which implies high-privilege access; however, the CVE description explicitly states 'contributor-level access and above,' and contributor is a low-privileged WordPress role - this discrepancy means the official score likely understates realistic exposure for sites with open registration or broad contributor assignment, and even a mid-sized municipal IT team in kielce managing a community WordPress instance could face this risk from internal users. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A contributor-level WordPress user navigates to an event they do not own and sets the webhook URL field to an internal target such as the AWS instance metadata endpoint (http://169.254.169.254/latest/meta-data/) or an internal administrative interface on the server's private network. When the webhook is triggered, the WordPress server issues a blind HTTP request to that host; the attacker infers host reachability and open services from timing differences or error behaviors. … |
| Remediation | Update the Eventin WordPress plugin to version 4.1.21 or later, which the vendor has confirmed addresses both the missing webhook URL validation and the absent event ownership check; the fix is documented in the WPScan advisory at https://wpscan.com/vulnerability/41bd0919-6ed3-4280-9657-8114c1b2a0e7/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated account creation in the Eventin WordPress plugin (all versions before 4.1.20) allows any remote attacker
Eventin WordPress plugin versions before 4.1.20 exposes stored customer records - including names and email addresses -
Broken authorization in the Eventin WordPress plugin before 4.1.16 lets unauthenticated visitors create orders and suppl
Local file inclusion in the Eventin WordPress plugin (all versions before 4.1.20) allows authenticated users holding edi
Eventin WordPress plugin versions from 4.1.9 through 4.1.19 exposes customer order records - including personal informat
Unauthenticated information disclosure in the Eventin WordPress plugin before 4.1.22 exposes private, draft, and pending
Unauthenticated payment bypass in the Eventin WordPress plugin before 4.1.19 lets any visitor fraudulently obtain valid
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to Local File In
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to Local File In
Reflected cross-site scripting in the Eventin WordPress plugin up to version 4.0.28 allows unauthenticated attackers to
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themewinter
The Event Manager, Events Calendar, Events Tickets for WooCommerce - Eventin plugin for WordPress is vulnerable to unaut
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today