CVE-2026-13168 Overview
The Eventin WordPress plugin before version 4.1.20 contains a broken access control flaw that exposes stored customer records. Users with contributor-level access or above can read other customers' personal data, including names and email addresses. The issue stems from missing authorization checks on endpoints that return customer information [CWE-200].
This vulnerability requires an authenticated account but does not require elevated privileges. Contributor is a low-trust role that many WordPress sites grant liberally, which widens the practical attack surface. Successful exploitation results in disclosure of personally identifiable information (PII) for event customers.
Critical Impact
Any authenticated user with contributor privileges or higher can enumerate customer names and email addresses stored by the Eventin plugin, exposing PII and enabling targeted phishing campaigns.
Affected Products
- Eventin WordPress plugin versions prior to 4.1.20
- WordPress sites using Eventin for event management and ticketing
- Any WordPress installation granting contributor-level or higher access to untrusted users
Discovery Timeline
- 2026-08-12 - CVE-2026-13168 published to the National Vulnerability Database (NVD)
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-13168
Vulnerability Analysis
The Eventin plugin stores customer records associated with event registrations and ticket purchases. These records include personally identifiable information such as full names and email addresses. The plugin exposes endpoints that return this data but fails to enforce proper capability checks on the requesting user.
A user authenticated at contributor level normally has permission only to create and edit their own posts. They should not have access to customer records collected by the plugin. Because the plugin relies on authentication rather than authorization, any logged-in user meeting the contributor threshold can read data belonging to other customers.
The disclosed data enables downstream attacks. Names and email addresses feed targeted phishing, credential-stuffing lists, and social engineering that references legitimate event attendance.
Root Cause
The root cause is missing or insufficient authorization enforcement on plugin endpoints that return customer data. The code path validates that a request originates from an authenticated session but does not verify that the caller has a legitimate need to view the requested records. This is a classic broken access control pattern mapped to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Attack Vector
Exploitation occurs over the network against a WordPress site with the vulnerable plugin installed. The attacker must first obtain a contributor-level account, which can be achieved through open registration, compromised credentials, or an insider. Once authenticated, the attacker issues requests to the plugin endpoints that return customer records and receives PII belonging to other users.
No user interaction from the victim is required. No specialized tooling is required beyond an authenticated HTTP client. See the WPScan Vulnerability Report for additional technical details.
Detection Methods for CVE-2026-13168
Indicators of Compromise
- Unusual volume of authenticated requests to Eventin plugin REST or AJAX endpoints from a single contributor account
- Contributor accounts accessing endpoints returning customer or attendee data they did not create
- Sequential enumeration patterns against customer or attendee record identifiers
- Newly registered contributor accounts issuing data-retrieval requests shortly after account creation
Detection Strategies
- Review WordPress access logs for wp-admin/admin-ajax.php and REST API calls referencing Eventin endpoints from low-privilege accounts
- Correlate low-privilege user sessions with responses containing customer email addresses or names
- Alert on outbound HTTP responses from the site that include multiple distinct email addresses in a single response body
Monitoring Recommendations
- Enable WordPress audit logging for plugin API calls and record the authenticated user and response size
- Baseline normal contributor activity and alert on deviations, particularly bulk data retrieval
- Monitor for account creation followed by immediate access to plugin data endpoints
How to Mitigate CVE-2026-13168
Immediate Actions Required
- Upgrade the Eventin plugin to version 4.1.20 or later on all WordPress sites
- Audit existing contributor, author, and editor accounts and remove any that are not required
- Review WordPress logs for signs of prior exploitation, focusing on contributor account activity against Eventin endpoints
- Notify customers if evidence of PII disclosure is found, in line with applicable data protection regulations
Patch Information
The vendor addressed the vulnerability in Eventin version 4.1.20 by adding proper capability checks to the affected endpoints. Site administrators should apply the update through the WordPress plugin management interface. Refer to the WPScan Vulnerability Report for the vendor's fix reference.
Workarounds
- Disable the Eventin plugin until the update to 4.1.20 can be applied
- Restrict registration to prevent untrusted users from obtaining contributor-level accounts
- Use a web application firewall (WAF) rule to block unauthenticated and low-privilege access to Eventin data endpoints
- Downgrade any non-essential contributor accounts to subscriber, which is not in scope for this vulnerability
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
