CVE-2026-15667: Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'eventlayout' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The etnmanageevent capability is assigned to Contributors by default, meaning any Contributor-level user can set the malicious eventlayout value via the REST API without any additional configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
eventin/event-calendar-event-registration-tickets-bookingto a version that resolves this vulnerability.Fixed in 4.1.22 - Configuration
Update capability mappings so that the etn_manage_event capability is not granted by default to the Contributor role; ensure only trusted roles can access the REST API functionality that accepts the event_layout parameter.
WordPress Eventin plugin (Event Calendar, Event Registration, Tickets & Booking) etn_manage_event capability assignment (default Contributor-level access) = remove default assignment to Contributors - Compensating control
Restrict REST API access for users with elevated permissions (e.g., limit to trusted IPs/allowlisted accounts) to reduce the likelihood that an authenticated Contributor can supply a malicious event_layout value.
Event History
Frequently Asked Questions
Which users can exploit this issue under the default configuration?
Any authenticated WordPress user with the Contributor role or higher can exploit it. Contributors receive the etn_manage_event capability by default, so no additional capability assignment is required.
What access and interface does an attacker need?
The attacker needs an authenticated account with Contributor-level access or above and must be able to submit a malicious event_layout value through the REST API. No user interaction is required.
When can this lead to PHP code execution?
The flaw allows inclusion and execution of arbitrary PHP files already present on the server. Code execution is possible where PHP file types can be uploaded and then included through the vulnerable parameter.
What is the immediate mitigation if the plugin cannot be updated?
Remove or tightly restrict Contributor-level and higher accounts that are not trusted, since Contributor access is sufficient by default. Restricting access to the affected REST API functionality can also prevent submission of malicious event_layout values.