CVE-2026-15406: Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'eventlayout' parameter parameter. This makes it possible for authenticated attackers, with custom-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with custom-level access or higher. The attack is remote, but it does not affect unauthenticated visitors.
What conditions are needed for code execution?
The attacker must be able to control the event_layout parameter and cause a PHP file available on the server to be included. Code execution is possible where PHP files can be uploaded and then included; otherwise, the issue may still expose local file contents or bypass access controls.
Which installations should be treated as affected?
Eventin versions up to and including 4.1.22 are affected. The provided information does not identify a configuration setting that disables the vulnerable behavior.
How can administrators assess whether exploitation may have occurred?
Review application and web-server logs for requests containing the event_layout parameter from authenticated users, especially custom-level or higher accounts. Also investigate unexpected PHP files on the server and suspicious activity from accounts with those permissions.