Local File Inclusion in Event Calendar Plugin for WordPress
CVE-2026-15406

7.5HIGH

Key Information:

Vendor

WordPress
Status
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce
Vendor
CVE Published:
9 September 2026

What is CVE-2026-15406?

The Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress contains a vulnerability that allows authenticated users with custom-level access to exploit the 'event_layout' parameter. This vulnerability enables the inclusion and execution of arbitrary .php files on the server. Attackers can leverage this flaw to execute malicious PHP code and potentially bypass access controls, leading to data exposure or unauthorized code execution, particularly if the server allows uploading and inclusion of .php file types.

Affected Version(s)

Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce 0 <= 4.1.22

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wp-event-solut...
https://plugins.trac.wordpress.org/browser/wp-event-solut...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.