CVE-2026-84898
Eventin < 4.1.21 - Contributor+ LFI via Event Layout Meta
MEDIUM 6.6EPSS 0.4%
The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files.
- Affected
- Eventin
- CVSS v3.1 CNA
- 6.6 MEDIUM
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H - EPSS
- 0.43% chance of exploitation in the next 30 days, 36th percentile
- Published
- 2026-09-05
- Updated
- 2026-09-06