Local File Inclusion in Eventin WordPress Plugin

The Eventin WordPress plugin (versions 4.1.22 and earlier) contains a Local File Inclusion (LFI) vulnerability identified as CVE-2026-15667. The flaw resides in the handling of the 'event_layout' parameter within the plugin's REST API functionality. Authenticated users with the 'etn_manage_event' capability - which is assigned to the Contributor role by default - can exploit this parameter to point the application to arbitrary local files. If an attacker can upload a file with a .php extension to the server, this vulnerability allows them to include and execute that code, resulting in remote code execution (RCE). This issue is significant as it provides a pathway for lateral movement, privilege escalation, and sensitive data exfiltration by users who are already within the WordPress site's administrative hierarchy.

Impact

Successful exploitation allows authenticated users with contributor-level permissions to execute arbitrary PHP code on the web server. This can lead to full site compromise, unauthorized database access, the modification of system configuration files, and the exfiltration of sensitive site data. Organizations relying on this plugin for event management are vulnerable if they allow untrusted users to hold contributor-level accounts.

Recommendation

• Update the Eventin WordPress plugin to the latest version immediately to remediate the vulnerability associated with CVE-2026-15667.
• Audit WordPress user roles and capabilities to identify accounts with the 'etn_manage_event' capability and restrict these to trusted administrators only.
• Implement file integrity monitoring to detect the creation of unexpected or unauthorized .php files on the web server filesystem.
• Restrict file upload directories to prevent execution (e.g., set 'noexec' flags on uploads directories) as a defense-in-depth measure.