Executive brief
Eventin is a popular WordPress plugin for managing events. A flaw in the plugin allows authenticated users with contributor-level permissions to include and execute arbitrary PHP files on the server by manipulating the event layout parameter. An attacker with a contributor account could exploit this to run malicious code, potentially compromising the website and accessing sensitive data.
Technical details
The plugin fails to properly validate the event_layout template path parameter before using it in a PHP include statement, resulting in a local file inclusion (LFI) vulnerability. An authenticated attacker with contributor-level access or above can craft a malicious event creation request via the REST API (/wp-json/eventin/v2/events) with a traversal payload in the event_layout field (e.g., "../../../../uploads/YYYY/MM/marker"). When the event page is rendered, the unsanitized path is included and executed as PHP code. Exploitation requires: (1) an active contributor account, (2) a theme with Eventin template-override support, and (3) a target PHP file already present on the server. The vulnerability is fixed in version 4.1.21.
Affected products
- Eventin Eventin before 4.1.21
Timeline
- 2026-09-03: disclosed
- 2026-09-03: patched: Fixed in version 4.1.21
- 2026-09-05: advisory