CVE-2026-13168: Eventin < 4.1.20 - Contributor+ Customer PII Disclosure via REST API
The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Eventin WordPress pluginto a version that resolves this vulnerability.Fixed in 4.1.20
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13168?
CVE-2026-13168 has a risk score of 48, indicating a moderate severity level.
How do I fix CVE-2026-13168?
To mitigate CVE-2026-13168, update the Eventin WordPress plugin to version 4.1.20 or later.
What does CVE-2026-13168 affect?
CVE-2026-13168 affects the Eventin WordPress plugin prior to version 4.1.20.
What type of vulnerability is CVE-2026-13168?
CVE-2026-13168 is classified as an information leak vulnerability.
Who is impacted by CVE-2026-13168?
Users with contributor-level access and above are impacted by CVE-2026-13168 as they can access other customers' personal data.