SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-15667

HIGH · CVSS 7.5 EPSS 0.56% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-09 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

The Eventin plugin for WordPress is vulnerable to Local File Inclusion, allowing authenticated users with contributor-level access and above to include and execute arbitrary PHP files on the server through the 'event_layout' parameter. This vulnerability can lead to unauthorized code execution, data exposure, and potential bypass of access controls. WordPress site administrators and developers using this plugin should prioritize immediate remediation to protect against potential exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
code execution

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-15667
Severity
HIGH
CVSS
7.5
EPSS
0.56%
WordPress

Original NVD Description

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The etn_manage_event capability is assigned to Contributors by default, meaning any Contributor-level user can set the malicious event_layout value via the REST API without any additional configuration.