CVE-2026-13172
Received Received - Intake

Information Disclosure in Eventin WordPress Plugin

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: WPScan

Description
The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces, allowing unauthenticated users to retrieve draft, pending and private posts belonging to other users, along with the passwords and contents of password-protected ones.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-13172
EUVD
EUVD-2026-66265

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
eventin wordpress_plugin to 4.1.22 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Eventin WordPress plugin before version 4.1.22 has a vulnerability in one of its REST API namespaces. This flaw allows unauthenticated users to access non-published content, including draft, pending, and private posts from other users. It also exposes passwords and contents of password-protected posts.

Detection Guidance

To detect this vulnerability, check if your Eventin WordPress plugin is outdated (version before 4.1.22). Inspect REST API responses for unauthorized access to draft, pending, or private posts. Review server logs for unusual API requests targeting the vulnerable namespace.

Impact Analysis

This vulnerability could allow attackers to view sensitive or unpublished content on your WordPress site without authentication. They may access drafts, private posts, or password-protected content, potentially exposing confidential information or intellectual property.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if it exposes personal or sensitive data. Unauthorized access to private or draft content may violate data protection requirements, leading to legal penalties or reputational damage.

Mitigation Strategies

Update the Eventin plugin to version 4.1.22 or later immediately. Restrict access to sensitive post statuses by reviewing user permissions and API endpoint configurations. Monitor for unauthorized data access and consider temporarily disabling the plugin if an update is not immediately available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13172. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart