Eventin WordPress Plugin CVE-2026-15667

Requires a WordPress user account at Contributor level or above - the etn_manage_event capability is assigned to Contributors by default so no special role configuration is needed. Requires the Eventin plugin to be active in versions ≤4.1.22. Requires a PHP file to already be present on the server at a path reachable by the include call (this is the AC:H condition); without a pre-existing PHP file, the attacker can only read non-PHP files via LFI, which still constitutes an information disclosure impact. REST API access must be available (standard on WordPress installations). Limiting factors: contributor account registration must be open or the attacker must have obtained credentials; AC:H reflects that PHP file placement is a prerequisite; no path-traversal to arbitrary filesystem locations is implied by the description - the file must be within the WordPress file tree or include path.

The CVSS 7.5 score (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a meaningful but constrained risk: the high complexity rating captures the requirement that a PHP file must already exist at an attacker-reachable path on the server before inclusion can be triggered. This two-stage dependency is the primary exploitation barrier. In WordPress environments, however, file upload plugins, theme editors, or misconfigured media handling can provide avenues for placing PHP payloads, making AC:H achievable in practice for determined attackers. The PR:L requirement (contributor-level access) is partially mitigated by WordPress sites that restrict open registration, but is a real concern on sites with community registration enabled. No EPSS score was provided in the input data. No CISA KEV listing exists and no public exploit has been confirmed, which lowers near-term exploitation probability. Despite the full C:H/I:H/A:H impact triad, actual exploitation depends on the file-upload chaining step - defenders should treat this as a high-priority patch but not an imminent zero-day response.

An attacker registers or obtains a contributor-level account on a target WordPress site running Eventin ≤4.1.22. They first upload a PHP webshell via a secondary vector (e.g., a misconfigured media upload handler or another vulnerable plugin), then send an authenticated REST API request setting the event_layout parameter to the relative path of the uploaded PHP file, causing the server to include and execute it and returning shell output. No public exploit code has been confirmed at time of analysis, but the REST API endpoint and vulnerable code paths are publicly documented via the Wordfence advisory and plugin trac references.