CVE-2026-13170

Name of the Vulnerable Software and Affected Versions Eventin WordPress plugin versions prior to 4.1.20

Description Insufficient validation of a template path setting allows users with editor-level access and above to include and execute arbitrary local PHP files. This is a Local File Inclusion (LFI) issue, which occurs when an application includes a file without properly validating the input, potentially allowing the execution of malicious code on the server.

Recommendations Update the Eventin WordPress plugin to version 4.1.20 or later.