CVE-2026-13175 — Eventin < 4.1.21 - Contributor+ Schedule Deletion and Modification via IDOR
The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access an…
Published: 2026-08-19 · CVSS: 6.5 · CVSS 3.1
The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7