CVE-2026-13169

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including administrators.

CVSS v3.1

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS

0.25% chance of exploitation in the next 30 days, 16th percentile

Published

2026-08-19

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/cf2b1152-7190-467b-a860-1f7bd806575d/

References

• CVE Record
• NVD entry

Related

• CVE-2026-13168
• CVE-2026-13170
• CVE-2026-13158
• CVE-2026-13171
• CVE-2026-13157
• CVE-2026-13172