EUVD-2026-57073
GHSA-prg9-j2xv-c876
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Requires contributor-level authentication (PR:L); network-accessible at low complexity; high confidentiality impact on customer PII with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses.
AnalysisAI
Eventin WordPress plugin versions before 4.1.20 exposes stored customer records - including names and email addresses - to any authenticated WordPress user holding contributor-level access or higher, due to missing server-side capability checks on customer data retrieval. A publicly available proof-of-concept exploit exists per the WPScan advisory, and an EPSS score of 15% places exploitation probability well above the median for medium-severity CVEs. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress account with at minimum contributor-level access on the target site - PR:L in the CVSS vector confirms this authentication prerequisite, and unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 score reflects a medium-severity finding with high confidentiality impact (C:H) but no integrity or availability dimensions, and the network attack vector combined with low privilege requirement (PR:L) creates a meaningful exposure surface in multi-user WordPress environments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who holds or obtains a contributor-level WordPress account on a site running Eventin before 4.1.20 sends crafted HTTP requests to the plugin's customer record endpoint without administrative credentials. Because the plugin fails to enforce a capability check, the server returns full customer records including names and email addresses belonging to other registrants. … |
| Remediation | Update the Eventin WordPress plugin to version 4.1.20 or later, which contains the vendor-released access control fix; this patch is confirmed available per the WPScan advisory at https://wpscan.com/vulnerability/2c5a4930-4676-4ae0-aeb4-1c99d5069361/ and documented in NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-13168. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated account creation in the Eventin WordPress plugin (all versions before 4.1.20) allows any remote attacker
Broken authorization in the Eventin WordPress plugin before 4.1.16 lets unauthenticated visitors create orders and suppl
Local file inclusion in the Eventin WordPress plugin (all versions before 4.1.20) allows authenticated users holding edi
Eventin WordPress plugin versions from 4.1.9 through 4.1.19 exposes customer order records - including personal informat
Unauthenticated information disclosure in the Eventin WordPress plugin before 4.1.22 exposes private, draft, and pending
Unauthenticated payment bypass in the Eventin WordPress plugin before 4.1.19 lets any visitor fraudulently obtain valid
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to Local File In
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to Local File In
Reflected cross-site scripting in the Eventin WordPress plugin up to version 4.0.28 allows unauthenticated attackers to
Blind server-side request forgery in the Eventin WordPress plugin prior to version 4.1.21 allows contributor-level authe
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themewinter
The Event Manager, Events Calendar, Events Tickets for WooCommerce - Eventin plugin for WordPress is vulnerable to unaut
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today