WordPress Plugin Vulnerabilities

Eventin < 4.1.21 - Contributor+ Schedule Deletion and Modification via IDOR

Description

The plugin does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users.

Proof of Concept

Affects Plugins

Plugin icon
wp-event-solution
Fixed in 4.1.21

References

CVE
CVE-2026-13175

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
Muni Nitish Kumar Yaddala
Submitter
Muni Nitish Kumar Yaddala
Verified
Yes
WPVDB ID
10762bf3-9663-40dc-9794-88ec7aa5b048

Timeline

Publicly Published
2026-08-17 (about 3 days ago)
Added
2026-08-17 (about 2 days ago)
Last Updated
2026-08-17 (about 2 days ago)

Other

Published
Title
Published
2025-10-24
Title
Tutor LMS Pro < 3.9.0 - Subscriber+ Other Assignments Access/Edit via IDOR
Published
2026-06-18
Title
WP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated Support Ticket Access via Session Cookie Forgery
Published
2025-06-24
Title
WP SmartPay < 2.8.0 - Authenticated (Subscriber+) Account Takeover
Published
2024-04-05
Title
ProfileGrid < 5.7.7 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-08-03
Title
Dokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint