Executive Summary
A vulnerability in the Eventin WordPress plugin before version 4.1.20 allows users with editor-level access and above to include and execute arbitrary local PHP files. This is due to improper validation of a template path setting used to include local files. The vulnerability has a significant impact as it can lead to arbitrary code execution.
Technical Analysis
The vulnerability class of CVE-2026-13170 is an arbitrary local file inclusion vulnerability. The attack vector involves users with editor-level access and above who can manipulate the template path setting to include arbitrary local PHP files. The root cause of this vulnerability is the lack of proper input validation on the template path setting.
How It Gets Exploited
An attacker with editor-level access and above can exploit this vulnerability by manipulating the template path setting to point to an arbitrary local PHP file. The attacker would send a crafted request with a malicious template path to the vulnerable plugin. When the plugin attempts to include the file at the specified path, it will execute the malicious PHP code. For example, an attacker could send a request with a template path like
../../../../etc/passwd or a malicious PHP file
/var/www/html/shell.php. The plugin's failure to validate the input allows the attacker to achieve arbitrary code execution.
Impact Assessment
The Eventin WordPress plugin versions before 4.1.20 are affected by this vulnerability. An attacker can achieve arbitrary code execution, which has a high impact on confidentiality, integrity, and availability. Although no CVSS score is provided, the impact can be considered severe.
Recommended Actions
To mitigate this vulnerability, it is recommended to update the Eventin WordPress plugin to version 4.1.20 or later. Additionally, users should ensure that only trusted and authenticated users have editor-level access and above. Monitoring plugin usage and restricting access can also help prevent exploitation.
Sources