CVE-2026-13171

The Eventin WordPress plugin prior to version 4.1.20 is vulnerable due to a lack of authorization checks in its waiting-list registration handler, enabling unauthenticated users to create WordPress accounts with arbitrary email addresses and inject order records. This vulnerability poses a significant risk of unauthorized access and data manipulation, making it critical for WordPress site administrators using this plugin to prioritize immediate updates to mitigate potential exploitation.