CVE-2026-13172 Overview
CVE-2026-13172 affects the Eventin WordPress plugin in versions before 4.1.22. The plugin exposes a REST API namespace that fails to restrict access to non-published content based on post status or ownership. Unauthenticated attackers can retrieve draft, pending, and private posts belonging to other users. The flaw also exposes the passwords and cleartext contents of password-protected posts. The issue is a missing authorization weakness classified as [CWE-862].
Critical Impact
Unauthenticated remote attackers can enumerate and read non-public WordPress content, including private posts and password-protected material, without any user interaction.
Affected Products
- Eventin WordPress plugin versions prior to 4.1.22
- WordPress sites with the Eventin plugin installed and REST API accessible
- Multisite WordPress installations running vulnerable Eventin versions
Discovery Timeline
- 2026-08-26 - CVE-2026-13172 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-13172
Vulnerability Analysis
The Eventin plugin registers REST API endpoints that return post objects without filtering by publication status or authorship. Standard WordPress REST behavior restricts unauthenticated callers to published content, but this namespace bypasses that model. As a result, an attacker issuing an unauthenticated HTTP request can retrieve posts marked draft, pending, and private. When the plugin returns password-protected posts, the response includes both the raw post password and the decrypted content that would normally require a password prompt.
Root Cause
The root cause is missing authorization on REST API controllers within the plugin. The controllers do not implement a permission_callback that validates the caller's capability to read non-public content. They also fail to filter results by post_status or by ownership before serializing responses. This is a classic missing authorization pattern [CWE-862] where business logic assumes read requests are safe without enforcing the WordPress capability model such as read_private_posts or edit_post.
Attack Vector
Exploitation requires only network access to the target site's REST API. An attacker sends a crafted GET request to the vulnerable Eventin namespace and receives JSON responses containing unpublished posts across all users. No authentication, session, or user interaction is required. Because the exposure is read-only, the impact is limited to confidentiality of pre-publication content and password-protected material. See the WPScan Vulnerability Report for technical details.
Detection Methods for CVE-2026-13172
Indicators of Compromise
- Unauthenticated GET requests targeting Eventin REST API routes under /wp-json/ returning large JSON payloads
- Access log entries from unfamiliar IP addresses enumerating REST namespaces registered by the plugin
- Responses containing post_status values of draft, pending, or private served to unauthenticated clients
Detection Strategies
- Review web server access logs for repeated requests to Eventin REST endpoints without an authenticated Cookie or Authorization header
- Audit installed plugin inventory to identify sites running Eventin versions earlier than 4.1.22
- Correlate REST API traffic spikes with response sizes that indicate bulk content retrieval
Monitoring Recommendations
- Enable verbose logging for the WordPress REST API and forward logs to a centralized SIEM for analysis
- Alert on any REST response that includes post_password field values or non-public post_status fields
- Track outbound egress from suspicious client IPs following REST enumeration activity
How to Mitigate CVE-2026-13172
Immediate Actions Required
- Update the Eventin plugin to version 4.1.22 or later on all WordPress installations
- Rotate any passwords used on password-protected posts that may have been exposed
- Review draft and private content that may have been accessed and treat sensitive material as disclosed
Patch Information
The vendor addressed the issue in Eventin 4.1.22 by restricting the affected REST namespace to authorized callers and filtering results by status and ownership. Site administrators should apply the update through the WordPress plugin manager or WP-CLI. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Deactivate the Eventin plugin until the patched version can be installed
- Restrict access to /wp-json/ endpoints at the web application firewall or reverse proxy layer
- Block unauthenticated requests to Eventin-specific REST routes using WAF rules until the update is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
