CVE-2026-13175

The Eventin WordPress plugin prior to version 4.1.21 is vulnerable as it fails to verify user ownership when modifying or deleting schedule records, enabling users with contributor-level access and higher to manipulate entries created by others. This could lead to unauthorized alterations or deletions of important scheduling data, potentially disrupting operations for affected sites. WordPress administrators using this plugin should prioritize updating to the latest version to mitigate this risk.