CVE-2026-13175: Eventin WordPress Auth Bypass Vulnerability

CVE-2026-13175 Overview

CVE-2026-13175 affects the Eventin WordPress plugin in versions prior to 4.1.21. The plugin fails to verify ownership before permitting schedule records to be modified or deleted. Authenticated users with contributor-level access or higher can alter or delete schedule entries created by other users. This flaw is categorized as an Insecure Direct Object Reference [CWE-639]. The issue enables horizontal privilege escalation across content authored by different users on the same site.

Critical Impact
Contributor-level accounts can tamper with or destroy schedule entries owned by other users, undermining data integrity and availability of event schedules.

Affected Products

Eventin WordPress plugin versions before 4.1.21
WordPress sites permitting contributor-level registration
Multi-author WordPress environments using Eventin for event scheduling

Discovery Timeline

2026-08-19 - CVE-2026-13175 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-13175

Vulnerability Analysis

The Eventin plugin exposes endpoints that accept schedule record identifiers for update and delete operations. The application does not validate whether the requesting user owns the target schedule record before executing the action. Any authenticated user holding the WordPress contributor role or higher can supply an arbitrary schedule identifier and perform destructive or modifying actions.

The vulnerability compromises integrity and availability without exposing confidential data. Exploitation requires only a valid authenticated session and network access to the WordPress site. No user interaction is required beyond issuing the crafted request.

Root Cause

The root cause is a missing authorization check on schedule record operations, classified as [CWE-639] Authorization Bypass Through User-Controlled Key. The plugin trusts client-supplied identifiers without cross-referencing the authenticated user against the record's owner. This design pattern is a canonical Insecure Direct Object Reference.

Attack Vector

An attacker authenticates with contributor-level credentials, either through legitimate registration on sites that allow it or through compromised accounts. The attacker then issues a modification or deletion request against the plugin's schedule endpoint, substituting the identifier of a schedule entry owned by another user. The server processes the request and applies the change. See the WPScan Vulnerability Report for further technical details.

Detection Methods for CVE-2026-13175

Indicators of Compromise

Unexpected modifications or deletions of Eventin schedule records not attributable to their original authors
WordPress audit log entries showing schedule mutation requests from contributor accounts operating on records they did not create
Repeated POST or DELETE requests to Eventin schedule REST endpoints from a single low-privileged account

Detection Strategies

Correlate authenticated request logs with schedule record ownership to identify cross-user write operations
Compare the WordPress user ID in session tokens against the author metadata of modified schedule posts
Alert on contributor-role accounts invoking Eventin update or delete endpoints at abnormal rates

Monitoring Recommendations

Enable WordPress activity logging that records the acting user, target object, and action for all Eventin operations
Forward WordPress and web server logs to a central platform for correlation and retention
Monitor Eventin database tables for row-level changes with authorship mismatches

How to Mitigate CVE-2026-13175

Immediate Actions Required

Update the Eventin plugin to version 4.1.21 or later on all WordPress installations
Audit existing contributor and higher-role accounts for legitimacy and revoke unused credentials
Review recent schedule record changes for unauthorized modifications and restore from backup where necessary

Patch Information

The Eventin maintainers addressed the missing ownership check in version 4.1.21. Site administrators should apply the update through the WordPress plugin dashboard or by deploying the updated plugin package. Confirm the installed version reads 4.1.21 or higher after the update.

Workarounds

Temporarily disable the Eventin plugin on sites where an immediate upgrade is not feasible
Restrict new user registration and reduce the number of accounts holding contributor or higher roles
Place the WordPress admin and REST API behind IP allowlists or a web application firewall rule blocking unauthenticated access to Eventin endpoints

bash

# Verify installed Eventin version via WP-CLI
wp plugin get wp-event-solution --field=version

# Update Eventin to the patched release
wp plugin update wp-event-solution --version=4.1.21