Is CVE-2026-11821 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11821 being exploited in the wild.

How severe is CVE-2026-11821?

Medium severity, with a CVSS score of 5.4, published 9 September 2026.

Which products and versions are affected?

Eventin – Event Calendar, Event Registration, Tickets & Booking up to and including 4.1.17.

Is there a fix for CVE-2026-11821?

A patch was published on 2026-09-09: Fixed in version 4.1.18 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-11821 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-11821?

Check whether you run Eventin – Event Calendar, Event Registration or Tickets & Booking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11821: Eventin Event Calendar authorization bypass in notification workflows

CVE-2026-11821 · Severity: medium · CVSS 5.4 · Published 2026-09-09

Eventin is a WordPress plugin providing event calendar and ticket booking functionality. The plugin fails to properly restrict access to notification automation workflows, allowing any authenticated user (even with basic subscriber permissions) to view, create, modify, and delete workflows that should only be available to site administrators. This could allow attackers to manipulate automated notifications, interfere with event operations, or access sensitive workflow configurations.

Vendors: Eventin.

Quick answers

Is CVE-2026-11821 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11821 being exploited in the wild.
How severe is CVE-2026-11821?: Medium severity, with a CVSS score of 5.4, published 9 September 2026.
Which products and versions are affected?: Eventin – Event Calendar, Event Registration, Tickets & Booking up to and including 4.1.17.
Is there a fix for CVE-2026-11821?: A patch was published on 2026-09-09: Fixed in version 4.1.18 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-11821 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-11821?: Check whether you run Eventin – Event Calendar, Event Registration or Tickets & Booking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Eventin plugin is vulnerable to authorization bypass due to insufficient access controls on the notification flow event automation API endpoints in the email notification SDK. The vulnerable component (FlowAPI.php) does not properly verify user capabilities before allowing operations on notification workflows. An authenticated attacker with subscriber-level or higher privileges can send requests to create, read, update, clone, or delete workflows without proper role-based authorization checks. The vulnerability requires authentication but no additional preconditions, and allows attackers to manipulate administrative-level workflow configurations. A fix was introduced in version 4.1.18 which adds proper capability verification to the affected endpoints.

Affected products

Eventin Eventin – Event Calendar, Event Registration, Tickets & Booking up to and including 4.1.17

Timeline

2026-09-09: disclosed
2026-09-09: patched: Fixed in version 4.1.18

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.