CVE-2026-13170 in Eventin Plugin
Summary
by MITRE • 08/10/2026
The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with editor-level access and above to include and execute arbitrary local PHP files.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The Eventin WordPress plugin vulnerability represents a critical local file inclusion flaw that exists in versions prior to 4.1.20, creating a significant security risk for WordPress installations. This issue stems from insufficient input validation within the plugin's template path handling mechanism, which allows authenticated users with editor privileges or higher to manipulate the file inclusion process. The vulnerability operates through a classic path traversal pattern where user-controllable input directly influences the include statement, bypassing proper sanitization checks that should prevent arbitrary file access.
The technical implementation of this flaw involves the plugin's failure to properly validate or sanitize the template path parameter before executing a local file inclusion operation. When an editor-level user submits a request containing a malicious template path, the plugin processes this input without adequate validation, resulting in the inclusion of arbitrary PHP files from the server's filesystem. This vulnerability falls under the CWE-22 category for Improper Limitation of a Pathname to a Restricted Directory, and aligns with ATT&CK technique T1505.003 for Data Manipulation through Local File Inclusion.
The operational impact of this vulnerability extends beyond simple privilege escalation, as it enables attackers to execute arbitrary code on the affected WordPress server with the privileges of the web application user. An attacker with editor access can leverage this flaw to upload malicious PHP payloads, establish persistent backdoors, or exfiltrate sensitive data from the server. The vulnerability also potentially allows for privilege escalation attacks against other users within the WordPress environment, especially when combined with other exploitation techniques.
Mitigation strategies should focus on immediate plugin updates to version 4.1.20 or later where the validation issues have been addressed. Organizations should implement strict input validation measures including whitelisting acceptable template paths, employing proper parameter sanitization, and restricting file inclusion operations to predefined directories. Network-level protections such as web application firewalls can provide additional defense in depth, while regular security audits of WordPress plugins should include checking for similar validation flaws. The vulnerability demonstrates the critical importance of proper input validation in web applications and aligns with industry best practices outlined in OWASP Top Ten and NIST cybersecurity guidelines for secure coding practices.