WordPress Plugin Vulnerabilities

Eventin < 4.1.22 - Unauthenticated Unpublished Content Disclosure

Description

The plugin does not restrict access to non-published content by status or ownership in one of its REST API namespaces, allowing unauthenticated users to retrieve draft, pending and private posts belonging to other users, along with the passwords and contents of password-protected ones.

Proof of Concept

Affects Plugins

Plugin icon
wp-event-solution
Fixed in 4.1.22

References

CVE
CVE-2026-13172

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Meher Sudhakar Abbireddi
Submitter
Meher Sudhakar Abbireddi
Verified
Yes
WPVDB ID
1b2d4b55-1b7e-4150-8f90-492f7a3d5400

Timeline

Publicly Published
2026-08-24 (about 3 days ago)
Added
2026-08-24 (about 2 days ago)
Last Updated
2026-08-24 (about 2 days ago)

Other

Published
Title
Published
2026-05-25
Title
B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More < 5.2.10 - Missing Authorization
Published
2025-04-02
Title
Clients <= 1.1.4 - Missing Authorization
Published
2024-12-23
Title
PlugVersions – Easily rollback to previous versions of your plugins < 0.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Creation
Published
2026-01-07
Title
Speed Kit <= 2.0.2 - Missing Authorization
Published
2026-01-27
Title
Frontend File Manager Plugin < 23.6 - Missing Authorization to Unauthenticated Arbitrary File Sharing via 'file_id' Parameter