CVE-2026-13170

The Eventin WordPress plugin prior to version 4.1.20 is vulnerable due to improper validation of the template path setting, enabling users with editor-level access or higher to include and execute arbitrary local PHP files. This flaw poses a significant risk as it could lead to remote code execution, potentially compromising the entire WordPress site. WordPress administrators and security teams should prioritize updating to the latest version to mitigate this vulnerability.