CVE-2026-13175

Deferred Deferred - Pending Action

Eventin Plugin Schedule Record Modification Vulnerability

Publication date: 2026-08-19

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-26

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-13175

EUVD

EUVD-2026-62261

Affected Vendors & Products

Vendor	Product	Version / Range
eventin	eventin	to 4.1.21 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the Eventin WordPress plugin before version 4.1.21. It allows users with Contributor-level access or higher to modify or delete schedule entries created by other users without verifying ownership.

Detection Guidance

To detect this vulnerability, check if your Eventin plugin version is below 4.1.21. Log in as a Contributor-level user and attempt to modify or delete schedule entries created by other users. If successful, the vulnerability exists.

Impact Analysis

If you use the Eventin plugin with a vulnerable version, unauthorized users could alter or delete schedule entries, potentially disrupting event management or causing data loss.

Compliance Impact

This vulnerability could lead to unauthorized modifications or deletions of schedule data, potentially violating integrity requirements in GDPR or HIPAA if such data is considered protected.

Mitigation Strategies

Immediately update the Eventin plugin to version 4.1.21 or later. If updating is not possible, consider disabling the plugin until the update is applied.

Hi! I’m here to help you understand CVE-2026-13175. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70