PT-2026-79366 · WordPress · Eventin
CVE-2026-13176
·
Published
2026-08-21
·
Updated
2026-08-21
CVSS v3.1
2.7
Low
| Vector | AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Eventin WordPress plugin versions prior to 4.1.21
Description
Insufficient validation of user-supplied webhook URLs stored on events and a failure to verify event ownership allow users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts. Blind server-side requests occur when a server is coerced into making a request to an external system without returning the response to the attacker.
Recommendations
Update Eventin WordPress plugin to version 4.1.21 or later.
Exploit
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Eventin