CVE-2026-13169
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including administrators.
Risk Assessment
Low-privileged users can take over administrator events, potentially leading to content manipulation and data integrity loss.
Recommendation
Update the plugin to version 4.1.21 or later, which includes fixes for event ownership verification.
Original NVD description (English source)
The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including administrators.