Eventin EUVD-2026-55023

Exploitation requires an active WordPress session authenticated at the editor role or higher (corresponding to CVSS PR:H). The attacker must have the ability to write or reference a PHP file at a locally accessible path - this typically requires a secondary file-write capability such as WordPress media uploads, FTP access, or another vulnerability that permits placing files on the server. The Eventin plugin must be installed and active on the target WordPress instance. Limiting factors: (1) editor-level WordPress authentication is a non-default privileged role requiring prior account compromise or insider threat; (2) a reachable, attacker-controlled PHP file must already exist on the server filesystem; (3) the vulnerability does not provide unauthenticated access - PR:N exploitation is not possible. No non-standard network configuration, unusual port exposure, or special server software beyond a standard PHP/WordPress stack is required.

The CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) accurately reflects a high-severity finding that is meaningfully bounded by the requirement for editor-level authentication, which prevents any unauthenticated exploitation path. The EPSS score of 0.16% at the 6th percentile is strikingly low relative to the CVSS score, suggesting limited or no automated scanning exploitation in the wild - this divergence is consistent with the absence of a CISA KEV entry. However, a publicly available proof-of-concept from WPScan substantially compresses the skill barrier, and a deployment with loosely managed editor accounts - even a mid-sized municipal IT team in kalisz running a community events portal on WordPress with Eventin - should treat this as an urgent upgrade rather than a deferred item, given that the full C/I/A impact means a compromised editor account can result in full site takeover. The primary risk mitigant is the PR:H prerequisite; the primary risk accelerant is the public POC and the broad delegation of editor roles in multi-author WordPress environments.

An attacker who possesses or compromises a WordPress account with editor-level privileges accesses the Eventin plugin's template configuration panel and sets the template path to reference a PHP file they have previously placed on the server - for example, a web shell uploaded via WordPress's media upload functionality or another file-write vector. When Eventin renders the template, the PHP runtime executes the attacker-supplied file with the web server process's privileges, enabling arbitrary command execution, database credential extraction, or persistent backdoor installation. The publicly available WPScan proof-of-concept lowers the technical barrier for this attack chain significantly.