Eventin EUVD-2026-63907

Exploitation requires at minimum a valid contributor-level WordPress account on the target installation - contributor is an authenticated but low-privileged role, above subscriber and below author, editor, and administrator. The Eventin plugin must be installed, activated, and running a version prior to 4.1.21. The webhook feature of the plugin must be accessible to contributors, which appears to be the default behavior given the vulnerability report. Sites with open user registration or shared contributor credentials face elevated exposure. The SSRF is blind, meaning no response data is returned to the attacker, which limits exploitation to host discovery and side-channel inference rather than direct exfiltration. Sites enforcing strict egress filtering at the network layer and restricting contributor role assignment to trusted users are substantially less exposed.

The official NVD CVSS score of 2.7 (Low) is derived from a PR:H vector, which implies high-privilege access; however, the CVE description explicitly states 'contributor-level access and above,' and contributor is a low-privileged WordPress role - this discrepancy means the official score likely understates realistic exposure for sites with open registration or broad contributor assignment, and even a mid-sized municipal IT team in kielce managing a community WordPress instance could face this risk from internal users. The SSRF is blind rather than full-read, which constrains impact to limited confidentiality signals and rules out direct data exfiltration as a primary concern. A publicly available proof-of-concept lowers the technical bar for exploitation, elevating practical risk modestly above what the low CVSS score suggests. No CISA KEV listing exists, so widespread active exploitation is not confirmed. Overall risk is low but not negligible: the POC availability and broader-than-documented privilege requirement justify patching in normal cycles, with priority elevated on sites allowing contributor self-registration.

A contributor-level WordPress user navigates to an event they do not own and sets the webhook URL field to an internal target such as the AWS instance metadata endpoint (http://169.254.169.254/latest/meta-data/) or an internal administrative interface on the server's private network. When the webhook is triggered, the WordPress server issues a blind HTTP request to that host; the attacker infers host reachability and open services from timing differences or error behaviors. A publicly available proof-of-concept facilitates this workflow with minimal technical skill required.