Eventin CVE-2026-13177

Exploitation requires an authenticated WordPress session with at minimum contributor-level role privileges - unauthenticated access is not sufficient. The vulnerable code path is within the Eventin plugin's order record retrieval functionality, which must be reachable (i.e., the plugin must be installed, active, and the site must have at least one recorded order). No special non-default configuration is required beyond having the Eventin plugin installed and operational. The key limiting factor is the contributor-level authentication prerequisite: an attacker must either possess a legitimate low-privilege account on the target WordPress installation or obtain one through registration (if open registration is enabled) or social engineering. Sites with open user registration accepting contributors are at higher risk. The scope is limited to Eventin order data only - this does not grant access to WordPress core user tables or other plugin data.

Despite a moderate CVSS base score of 4.3, several signals elevate real-world risk above the score alone. The EPSS score of 14% is high relative to typical WordPress plugin CVEs, suggesting active reconnaissance or exploitation attempts in the wild. A public proof-of-concept is documented by WPScan, confirming that exploitation capability is widely accessible. SSVC assessment confirms POC-level exploitation, non-automatable (contributor-level authentication is required, limiting mass exploitation), and partial technical impact. The confidentiality impact is the primary concern - customer PII exposure from order records can carry GDPR and PCI-DSS implications for affected site operators, which the raw CVSS score understates. A critical discrepancy exists in the provided CVSS vector: it reports C:N (no confidentiality impact) and I:L (low integrity impact), which is inconsistent with the description - the vulnerability explicitly enables reading other customers' personal information, a confidentiality breach, not an integrity violation. This suggests the NVD CVSS mapping may be erroneous; security teams should treat confidentiality as the primary impacted metric. The non-automatable SSVC rating is the key limiting factor: the contributor authentication prerequisite prevents unauthenticated mass exploitation.

A threat actor registers a contributor account on a WordPress site running an unpatched version of Eventin - or an existing contributor-level employee acts maliciously. The attacker calls the order-retrieval endpoint repeatedly with sequentially iterated order IDs (e.g., order IDs 1 through 10,000), harvesting name, email, address, and purchase data for every customer who has placed an event ticket order. A public proof-of-concept from WPScan documents the exploitation method, making this accessible to low-skill attackers.