# CVE-2026-13176: Eventin WordPress plugin server-side request forgery in webhook URL

Source: https://junglewise.ai/threats/cve-2026-13176-eventin-wordpress-plugin-server-side-request-forgery-in-webhook  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-13176 · Severity: low · CVSS 2.7 · Published 2026-08-21

Eventin is a popular WordPress plugin that manages event ticketing and bookings. The plugin fails to properly validate webhook URLs and verify event ownership, allowing contributors and higher-privileged users to inject arbitrary webhook destinations and trigger server-side requests to internal networks or external hosts. This could be exploited to probe internal infrastructure, interact with private services, or launch further attacks.

## Quick answers

**Is CVE-2026-13176 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13176 being exploited in the wild.

**How severe is CVE-2026-13176?** Low severity, with a CVSS score of 2.7, published 21 August 2026.

**Which products and versions are affected?** ZYNITH Eventin before 4.1.21.

**Is there a fix for CVE-2026-13176?** A patch was published on 2026-08-21: Fixed in version 4.1.21 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-13176 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-13176?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a server-side request forgery (SSRF) in the Eventin plugin before 4.1.21. The plugin accepts user-supplied webhook URLs via the REST API endpoint /wp-json/eventin/v2/events/{id} without validation and does not verify event ownership. An authenticated user with contributor-level access or above can modify an event's webhook URL to point to an arbitrary host. When a ticket order is placed (which does not require authentication), the plugin automatically sends a POST request to the stored webhook URL with customer details. The attacker never receives the response (blind SSRF), but the request is still issued, allowing reachability testing to loopback, private, and link-local addresses. Fixed in version 4.1.21.

## Affected products

- ZYNITH Eventin before 4.1.21

## Timeline

- 2026-08-17: disclosed
- 2026-08-21: patched: Fixed in version 4.1.21

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://wpscan.com/vulnerability/41bd0919-6ed3-4280-9657-8114c1b2a0e7/](https://wpscan.com/vulnerability/41bd0919-6ed3-4280-9657-8114c1b2a0e7/)