CVE-2026-13168

Deferred Deferred - Pending Action

Eventin WordPress Plugin Customer Data Exposure Vulnerability

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-13168

EUVD

EUVD-2026-57073

Affected Vendors & Products

Vendor	Product	Version / Range
eventin	eventin_wordpress_plugin	to 4.1.20 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

The Eventin WordPress plugin before version 4.1.20 has an improper access control flaw. Users with contributor-level access or higher can exploit the REST API to read stored customer records containing personally identifiable information such as names and email addresses.

Detection Guidance

Check if your Eventin WordPress plugin version is below 4.1.20. Users with contributor-level access or higher can test by attempting to access customer records via the REST API endpoints. Look for unauthorized exposure of names and email addresses in API responses.

Impact Analysis

Attackers with basic WordPress user roles could access and steal customer data, leading to privacy breaches, identity theft risks, or misuse of personal information. Businesses may face reputational damage and legal consequences.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and failure to implement proper access controls. It may also breach HIPAA if customer data includes protected health information, as unauthorized access is a compliance failure.

Mitigation Strategies

Update the Eventin WordPress plugin to version 4.1.20 or later immediately. Review user roles and permissions to ensure only necessary access is granted. Monitor API logs for suspicious access attempts to customer data.

Hi! I’m here to help you understand CVE-2026-13168. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70