Eventin CVE-2026-15406

Exploitation requires: (1) a valid WordPress user account with custom-level access or above (PR:L) - unauthenticated visitors cannot trigger this path; (2) the ability to supply a controlled value to the event_layout parameter via at least one of three documented code paths in template-functions.php:480, EventController.php:1041, or EventController.php:2165; and (3) a PHP file already present on the server in a location reachable by PHP's include() (AC:H) - this typically requires chaining with a file-upload vulnerability, misconfigured upload directory, or hosting control-panel access. Code execution is not achievable via LFI alone if the hosting environment blocks PHP execution in writable directories (e.g., php_flag engine off in uploads). The attack does not affect sites that enforce strict role separation and prevent all custom-role users from writing files to the server.

The CVSS 7.5 High score accurately captures the tension between high impact and meaningful exploitability constraints. AC:H reflects that LFI alone does not achieve code execution - a PHP file must first be present on the server in a web-accessible or include()-reachable path, meaning this must be chained with a separate file-write or upload primitive. PR:L requires the attacker to hold a valid WordPress account with at least custom-level access, excluding anonymous exploitation entirely. No EPSS score was provided in the available intelligence, and the vulnerability carries no CISA KEV listing. Despite elevated attack complexity, organizations operating Eventin in public event-registration deployments are at non-trivial risk because custom WordPress roles (event organizer, venue manager) are routinely granted to external or semi-trusted parties, and many WordPress hosting environments permit PHP file uploads via other plugins or media-upload misconfigurations. The Wordfence advisory includes precise source-line references covering three code paths, which substantially lowers the research burden for exploit construction once the upload prerequisite is satisfied.

An attacker who has been granted a custom event-organizer role on a WordPress site running Eventin uploads a PHP webshell to the server using a separate file-upload capability - such as a misconfigured media upload, another vulnerable plugin, or direct hosting-panel access. The attacker then sends a crafted request to an Eventin API endpoint with the event_layout parameter set to the relative or absolute path of the uploaded PHP file; the plugin's include() call executes the webshell, returning an interactive command shell running as the web-server user. No public exploit code has been identified at time of analysis, but the three documented source-line entry points make the attack straightforward to reconstruct.