CVE-2026-13176: Eventin < 4.1.21 - Contributor+ Server-Side Request Forgery
The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with contributor-level access or higher can exploit it. The issue does not require user interaction.
What access does exploitation provide?
The attacker can cause the server to make blind requests to arbitrary hosts through an event webhook URL. The available information indicates low confidentiality impact and no integrity or availability impact.
Which deployments are affected?
Eventin versions before 4.1.21 are affected. Exploitation depends on users having contributor-level or higher access and being able to store or trigger event webhook URLs.