Eventin Plugin EUVD-2026-66265

No special conditions are required for exploitation: the Eventin plugin (any version before 4.1.22) simply needs to be installed and active on a WordPress site accessible over the network. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote, unauthenticated exploitation against default plugin configurations with no user interaction. The limiting factor is that impact is restricted to confidentiality only - no content modification or site takeover is possible through this flaw alone. Exploitation is further limited to sites that actually have private, draft, pending, or password-protected posts; sites using Eventin purely for public event listings with no restricted content have reduced data exposure risk, though the endpoint remains accessible.

The CVSS 5.3 (Medium) score reflects a purely confidentiality-limited, unauthenticated network-accessible flaw with no integrity or availability impact - consistent with the actual behavior described. The EPSS score of 0.18% (7th percentile) indicates statistically low exploitation probability, and SSVC confirms exploitation status as 'none' at time of analysis, meaning no active exploitation has been observed. However, the SSVC also rates the attack as 'Automatable: yes,' meaning mass scanning and bulk exfiltration of private post content from all vulnerable Eventin installations is trivially achievable with a script - even a small hosting provider or municipal WordPress deployment should not treat the low EPSS as a reason to delay patching. A publicly available exploit exists per the WPScan reference, which elevates the realistic near-term risk above what the EPSS percentile alone would suggest. The combination of no authentication required, full network accessibility, and a public PoC means the window between patch release and active exploitation may be short. The moderate CVSS score is accurate but should not be taken as license to deprioritize patching - the automatable, unauthenticated nature of the flaw makes it a candidate for opportunistic mass exploitation.

An unauthenticated attacker sends HTTP GET requests to the vulnerable Eventin REST API namespace endpoint - no credentials, tokens, or prior reconnaissance of user accounts required. The attacker enumerates and downloads the full content of all draft, pending, private, and password-protected posts, including their plaintext access passwords. A publicly available proof-of-concept makes this trivially scriptable for bulk scanning across many WordPress installations.