CVE-2026-15667: Eventin WordPress Plugin RCE Vulnerability

CVE-2026-15667 Overview

CVE-2026-15667 is a Local File Inclusion (LFI) vulnerability in the Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress. The flaw affects all versions up to and including 4.1.22 through the event_layout parameter. Authenticated attackers with Contributor-level access or above can include and execute arbitrary .php files on the server. Successful exploitation enables access control bypass, sensitive data disclosure, and potential remote code execution when combined with a file upload primitive. The vulnerability is tracked under CWE-98 (Improper Control of Filename for Include/Require Statement).

Critical Impact
Contributor-level users can leverage the etn_manage_event capability to inject arbitrary PHP file paths through the REST API, leading to server-side code execution.

Affected Products

Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress
All plugin versions up to and including 4.1.22
WordPress sites permitting Contributor-level registration or account creation

Discovery Timeline

2026-09-09 - CVE-2026-15667 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-15667

Vulnerability Analysis

The Eventin plugin exposes a REST API endpoint for managing event layout templates. The event_layout parameter is passed into a PHP include or require statement without adequate normalization or allow-list validation. Attackers can supply a crafted value that resolves to an arbitrary .php file path on the server. The included file is then executed within the WordPress process context.

The plugin assigns the etn_manage_event capability to Contributor roles by default. Contributors do not require elevated permissions or additional configuration to reach the vulnerable code path. This significantly widens the exploitable population on sites that permit self-registration or grant Contributor rights broadly.

Root Cause

The root cause is improper control of a filename passed to a PHP include directive, tracked under CWE-98. The plugin trusts the event_layout string supplied via REST API input and constructs a template path used inside include or require operations. Relevant sinks and permission logic can be reviewed in the WordPress Template Functions Code and the WordPress Permission Control Code.

Attack Vector

An authenticated attacker with Contributor privileges sends a REST API request that sets event_layout to a path referencing an arbitrary PHP file. The server includes and executes that file. When paired with any writable location that permits .php content, this enables remote code execution. Additional context is available in the WordPress Event API Controller Code and the Wordfence Vulnerability Report.

// Vulnerability described in prose only - no verified PoC available.
// See vendor references above for source-level analysis of the sink.

Detection Methods for CVE-2026-15667

Indicators of Compromise

REST API requests to Eventin event endpoints containing event_layout values with directory traversal sequences such as ../ or absolute filesystem paths.
Unexpected PHP file access originating from the plugin directory wp-content/plugins/wp-event-solution/.
New or modified .php files appearing in WordPress upload directories following Contributor-account activity.
Outbound network connections initiated by the PHP-FPM or web server process shortly after event management API calls.

Detection Strategies

Inspect WordPress access logs for POST or PUT requests to the Eventin REST routes referencing event_layout parameters.
Deploy Web Application Firewall (WAF) rules that flag include-style parameters containing path separators or file extensions.
Correlate Contributor authentication events with subsequent REST calls that modify event templates.
Use file integrity monitoring on the WordPress wp-content/uploads/ and plugin directories to identify unauthorized PHP files.

Monitoring Recommendations

Enable verbose logging on the WordPress REST API and forward events to a centralized log platform for correlation.
Monitor process telemetry from the web server for unexpected child processes spawned by PHP interpreters.
Track newly created Contributor accounts and audit their API activity for signs of layout parameter tampering.

How to Mitigate CVE-2026-15667

Immediate Actions Required

Update the Eventin plugin to a version later than 4.1.22 as soon as the vendor releases a fixed build.
Audit all Contributor-level and higher accounts, removing unused or unrecognized users.
Restrict who can register or hold the Contributor role and disable open registration where not required.
Review the WordPress uploads directory for unauthorized .php files and revoke sessions for accounts showing suspicious API activity.

Patch Information

Refer to the vendor changeset published at the WordPress Event Solution Changeset for the code changes that address the vulnerable include path. Confirm the installed plugin version reports a release higher than 4.1.22 after applying the update.

Workarounds

Deploy WAF rules that block REST API payloads containing event_layout values with ../, absolute paths, or .php suffixes.
Configure the web server to deny PHP execution within the WordPress uploads directory using directives such as an .htaccess deny rule or an Nginx location block.
Temporarily revoke the etn_manage_event capability from the Contributor role using a role management plugin until a patch is installed.

bash

# Example Nginx configuration to block PHP execution in uploads
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}