CVE-2026-13170: Eventin WordPress Plugin Arbitrary Local PHP File Inclusion Vulnerability
The Eventin WordPress plugin before 4.1.20 is vulnerable to arbitrary local PHP file inclusion. Users with editor-level access and above can exploit this vulnerability to include and execute arbitrary local PHP files. This vulnerability has not been reported as actively exploited.