Eventin WordPress Plugin CVE-2026-84898

Exploitation requires a valid WordPress account at contributor level or higher (Contributor, Author, Editor, or Administrator). On many WordPress event sites this is a low barrier, as contributor accounts are frequently granted to event organizers or volunteers. The vulnerable code path is exercised only when the Eventin plugin is installed and active. No special server configuration beyond a standard WordPress+PHP stack is needed - any locally accessible PHP file on the server is a valid LFI target. The CVSS vector PR:H appears inconsistent with the description's 'contributor-level' threshold; PR:L is the accurate representation. There is no requirement for administrator interaction after the request is submitted.

The published CVSS vector (PR:H/AC:H) appears to understate accessibility: the description explicitly states contributor-level access suffices, which is PR:L in CVSS terms, and exploitation of a path-traversal-to-LFI flaw typically requires only a valid path string - no complex preconditions beyond possessing that account. EPSS at 0.16% (5th percentile) and SSVC 'Exploitation: none' suggest no widespread automated attacks currently, but this conflicts with the confirmed public POC from WPScan. The SSVC 'Technical Impact: total' and SSVC 'Automatable: no' combination signals that while individual exploitation is high-impact (full C/I/A), mass scanning is constrained by the need for an authenticated session. Real-world risk is therefore elevated for sites that allow open contributor registration or whose contributor accounts may be compromised - even a mid-sized municipal IT team in kalisz running a public WordPress event portal should treat this as urgent given the POC availability and full-compromise potential.

An attacker registers or compromises a WordPress contributor account on a target site running Eventin before 4.1.21. They then submit a crafted HTTP request containing a path-traversal string as the template path parameter, directing the plugin's include routine to a PHP web shell or configuration file already present on the server (e.g., a previously uploaded file or a known writable path). Because a public POC is available via WPScan, an attacker with basic PHP knowledge can adapt it quickly.