Authorization Flaw in Eventin WordPress Plugin by Eventin
CVE-2026-13169
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-13169?
The Eventin WordPress plugin prior to version 4.1.21 lacks adequate verification of event ownership, enabling users with contributor-level access or higher to modify, delete, or reassign events created by other users, including those with administrator privileges. This oversight poses significant risks, as it could allow unauthorized manipulation of critical event data across the platform.
Affected Version(s)
Eventin 0 < 4.1.21
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.