CVE-2026-13176 Overview
CVE-2026-13176 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in the Eventin WordPress plugin before version 4.1.21. The plugin fails to validate user-supplied webhook URLs stored on events and does not verify event ownership. Any authenticated user with contributor-level access or higher can configure webhook URLs pointing to arbitrary hosts. When the plugin triggers webhook delivery, the WordPress server issues blind HTTP requests to attacker-controlled destinations. The flaw allows adversaries to probe internal networks and interact with services reachable only from the web server.
Critical Impact
Contributor-level users can force the WordPress server to send blind HTTP requests to arbitrary internal or external hosts.
Affected Products
- Eventin WordPress plugin versions before 4.1.21
- WordPress installations exposing contributor-level or higher registration
- Sites using Eventin event management functionality
Discovery Timeline
- 2026-08-21 - CVE-2026-13176 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-13176
Vulnerability Analysis
The Eventin plugin exposes an event configuration surface that accepts a webhook URL for outbound notifications. The plugin stores this URL without validating its scheme, host, or destination. It also fails to check whether the requesting user owns the target event. This combination breaks two security boundaries: input validation and object-level authorization.
When the plugin later dispatches webhook events, the WordPress host sends outbound HTTP requests to the stored URL. Attackers exploit this to reach internal-only endpoints, cloud metadata services, or intranet applications that trust requests originating from the WordPress server. The responses are not returned to the attacker, making this a blind SSRF.
Root Cause
The root cause is missing validation of the webhook_url field combined with a broken access control check on the event object. The plugin trusts contributor-supplied input and does not enforce ownership on event modification endpoints. See the WPScan Vulnerability Report for advisory details.
Attack Vector
An attacker with contributor-level credentials authenticates to the WordPress site, creates or edits an event, and sets the webhook URL to an internal target such as http://127.0.0.1:8080/admin or a cloud metadata endpoint. When the webhook fires, the server issues a request to that destination. Because the response is not surfaced to the attacker, exploitation relies on timing, error signals, or side effects at the target service.
Detection Methods for CVE-2026-13176
Indicators of Compromise
- Outbound HTTP requests from the WordPress host to internal IP ranges (RFC1918) or link-local addresses such as 169.254.169.254
- Webhook URLs stored in Eventin event records pointing to loopback, private, or metadata addresses
- Contributor accounts creating or modifying events with unusual webhook configurations
- Web server initiating connections to ports not typically associated with external services
Detection Strategies
- Audit the Eventin database tables for webhook URL values referencing non-public hostnames or IP literals
- Correlate WordPress access logs showing contributor-level event modifications with subsequent outbound requests from the server
- Inspect PHP process network telemetry for connections initiated by wp-cron or webhook dispatch handlers
Monitoring Recommendations
- Log and alert on egress traffic from web servers destined for internal subnets or cloud metadata IPs
- Monitor WordPress role changes and contributor account creation for anomalous activity
- Track Eventin plugin version across the estate and flag installations below 4.1.21
How to Mitigate CVE-2026-13176
Immediate Actions Required
- Upgrade the Eventin plugin to version 4.1.21 or later on all WordPress sites
- Review existing event records for webhook URLs pointing to internal or unexpected hosts and remove them
- Audit contributor and author accounts, disabling any that are unused or unverified
Patch Information
The vendor addressed the issue in Eventin version 4.1.21 by adding webhook URL validation and enforcing event ownership checks. Administrators should apply the update through the WordPress plugin manager. Refer to the WPScan Vulnerability Report for the vendor's fix reference.
Workarounds
- Restrict outbound network access from the WordPress server to only required external destinations using egress firewall rules
- Block requests from the web server to RFC1918, loopback, and cloud metadata address ranges
- Temporarily remove contributor-level access from untrusted users until the patch is applied
- Disable the Eventin plugin if it is not in active use
# Example egress restriction using iptables to block metadata access
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j DROP
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.0/8 ! -o lo -j DROP
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
