CVE-2026-13175
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users.
Risk Assessment
Low-privileged users can disrupt events by deleting or modifying others' schedules, potentially leading to organizational chaos.
Recommendation
Update the plugin to version 4.1.21 or later, which includes fixes for ownership verification.
Original NVD description (English source)
The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users.