CVE-2026-13170 Overview
CVE-2026-13170 is a local file inclusion (LFI) vulnerability in the Eventin WordPress plugin before version 4.1.20. The plugin does not properly validate a template path setting before using it to include a local file. Users with editor-level access or higher can include and execute arbitrary local PHP files on the server. The flaw is categorized under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory).
Critical Impact
Authenticated editors can execute arbitrary PHP files on the underlying WordPress host, leading to full site compromise.
Affected Products
- Eventin WordPress plugin versions prior to 4.1.20
- WordPress installations running the vulnerable plugin
- Sites permitting editor-level or higher user roles
Discovery Timeline
- 2026-08-10 - CVE-2026-13170 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-13170
Vulnerability Analysis
The Eventin plugin exposes a template path configuration that is passed to a PHP file inclusion function without adequate validation or sanitization. An authenticated attacker with editor privileges can supply a path that traverses outside the intended template directory. The resulting inclusion evaluates PHP content from an arbitrary local file. When combined with any pre-existing writable file on the host, this converts the primitive into authenticated remote code execution. The plugin's use of user-controlled input in a filesystem context is the defining characteristic of a path traversal issue described by [CWE-22].
Root Cause
The root cause is missing validation of the template path setting. The plugin trusts operator-supplied input and passes it directly into an inclusion routine. There is no allowlist of permitted templates, no normalization of .. sequences, and no restriction to the plugin's own directory tree. See the WPScan Vulnerability Details for the underlying analysis.
Attack Vector
Exploitation requires an authenticated session with editor-level privileges or higher. The attacker modifies the template path setting to reference a local PHP file outside the expected directory. When the plugin renders the template, PHP evaluates the referenced file. Common targets include log files, uploaded media containing PHP payloads, and session files under /tmp. The attack is delivered over the network through the standard WordPress admin interface.
No verified public proof-of-concept code is available. Refer to the linked WPScan advisory for technical details.
Detection Methods for CVE-2026-13170
Indicators of Compromise
- Unexpected modifications to Eventin plugin template path options in wp_options or plugin-specific tables.
- PHP files written to wp-content/uploads/ or other writable directories with recent timestamps.
- Web access log entries showing editor accounts saving unusual template settings followed by rendering requests.
- Outbound network connections from the PHP-FPM or web server process to unfamiliar hosts.
Detection Strategies
- Monitor WordPress audit logs for changes to Eventin configuration by users with the editor role.
- Inspect included file paths in PHP open_basedir violations or error logs for traversal sequences such as ../.
- Alert on new PHP files appearing in upload directories that are typically restricted to media assets.
Monitoring Recommendations
- Enable file integrity monitoring across wp-content/plugins/eventin/ and site upload paths.
- Forward WordPress and web server logs to a centralized analytics platform for correlation with process telemetry.
- Track user role assignments to ensure editor privileges are granted only to trusted accounts.
How to Mitigate CVE-2026-13170
Immediate Actions Required
- Update the Eventin plugin to version 4.1.20 or later on every WordPress installation.
- Audit the list of users holding editor role or higher and revoke unnecessary privileges.
- Review recent changes to plugin settings and rotate credentials for any account that could have made unauthorized changes.
- Scan the webroot for unfamiliar PHP files and remove any confirmed webshells.
Patch Information
The vendor addressed the issue in Eventin 4.1.20 by validating the template path before inclusion. Details are documented at the WPScan Vulnerability Details entry.
Workarounds
- Temporarily deactivate the Eventin plugin until the patched version is deployed.
- Restrict editor-level accounts through a web application firewall rule that blocks unexpected template path parameters.
- Enforce PHP open_basedir restrictions to confine file inclusion to the WordPress installation directory.
# Configuration example: restrict PHP inclusion scope via php.ini
open_basedir = "/var/www/html/:/tmp/"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
