CVE-2026-13169 — Eventin < 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDOR

CVE-2026-13169

Eventin < 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDOR PUBLISHED

Description (CNA)

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including administrators.

Affected (CNA)

Vendor / product	Versions
Unknown / Eventin	affected 0 before 4.1.21

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/cf2b1152-7190-467b-a860-1f7bd806575d/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.