CVE-2026-13176CWE-918ssrf

CVE-2026-13176

Low · published August 21, 2026

CVSS v3.1
2.7
EPSS
0%
Percentile
24.3
In the wild
Unconfirmed
What it is

The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00325 · 24.3th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-08-21T16:16Z
References (1)
https://wpscan.com/vulnerability/41bd0919-6ed3-4280-9657-8114c1b2a0e7/ · [email protected]
EPSS history
Timeline
  • 21 AUG 11:40Z
    Eventin < 4.1.21 - Contributor+ Server-Side Request Forgery
    cvelistv5