Executive brief
Eventin is a popular WordPress plugin that manages event ticketing and bookings. The plugin fails to properly validate webhook URLs and verify event ownership, allowing contributors and higher-privileged users to inject arbitrary webhook destinations and trigger server-side requests to internal networks or external hosts. This could be exploited to probe internal infrastructure, interact with private services, or launch further attacks.
Technical details
The vulnerability is a server-side request forgery (SSRF) in the Eventin plugin before 4.1.21. The plugin accepts user-supplied webhook URLs via the REST API endpoint /wp-json/eventin/v2/events/{id} without validation and does not verify event ownership. An authenticated user with contributor-level access or above can modify an event's webhook URL to point to an arbitrary host. When a ticket order is placed (which does not require authentication), the plugin automatically sends a POST request to the stored webhook URL with customer details. The attacker never receives the response (blind SSRF), but the request is still issued, allowing reachability testing to loopback, private, and link-local addresses. Fixed in version 4.1.21.
Affected products
- ZYNITH Eventin before 4.1.21
Timeline
- 2026-08-17: disclosed
- 2026-08-21: patched: Fixed in version 4.1.21