CVE-2026-13170
Received Received - Intake

Eventin WordPress Plugin Local File Inclusion Vulnerability

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: WPScan

Description
The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with editor-level access and above to include and execute arbitrary local PHP files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-13170
EUVD
EUVD-2026-55023

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
eventin eventin_wordpress_plugin to 4.1.20 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Eventin WordPress plugin before version 4.1.20 has a Local File Inclusion (LFI) vulnerability. It fails to properly validate the speaker_template setting, allowing users with editor-level access or higher to include and execute arbitrary local PHP files by manipulating the template path.

Detection Guidance

Check if the Eventin WordPress plugin version is below 4.1.20. Look for unauthorized file inclusions in web server logs or suspicious PHP file executions by users with editor-level access or higher.

Impact Analysis

An attacker with editor-level access or higher could execute malicious PHP code on your server, potentially leading to full system compromise, data theft, or unauthorized access to sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA compliance requirements. It may result in data breaches, legal penalties, and reputational damage.

Mitigation Strategies

Update the Eventin WordPress plugin to version 4.1.20 or later immediately. Restrict editor-level access to only trusted users and monitor for unusual file inclusion activities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13170. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart