CVE-2026-13169CWE-639

CVE-2026-13169

High · published August 19, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
27.4
In the wild
Unconfirmed
What it is

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including administrators.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00350 · 27.4th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-08-19T10:17Z
References (1)
https://wpscan.com/vulnerability/cf2b1152-7190-467b-a860-1f7bd806575d/ · [email protected]
EPSS history
Timeline
  • 19 AUG 06:00Z
    Eventin < 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDOR
    cvelistv5