Eventin (<= 4.1.22) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/eventin--4.1.22/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 09 Sep 2026 03:51:49 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLocal File Inclusion in Eventin WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-09-eventin-lfi/Wed, 09 Sep 2026 03:51:49 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-eventin-lfi/The Eventin WordPress plugin contains a local file inclusion vulnerability in the event_layout parameter, allowing authenticated contributors to execute arbitrary PHP code.The Eventin WordPress plugin (versions 4.1.22 and earlier) contains a Local File Inclusion (LFI) vulnerability identified as CVE-2026-15667. The flaw resides in the handling of the 'event_layout' parameter within the plugin's REST API functionality. Authenticated users with the 'etn_manage_event' capability - which is assigned to the Contributor role by default - can exploit this parameter to point the application to arbitrary local files. If an attacker can upload a file with a .php extension to the server, this vulnerability allows them to include and execute that code, resulting in remote code execution (RCE). This issue is significant as it provides a pathway for lateral movement, privilege escalation, and sensitive data exfiltration by users who are already within the WordPress site's administrative hierarchy.

Impact

Successful exploitation allows authenticated users with contributor-level permissions to execute arbitrary PHP code on the web server. This can lead to full site compromise, unauthorized database access, the modification of system configuration files, and the exfiltration of sensitive site data. Organizations relying on this plugin for event management are vulnerable if they allow untrusted users to hold contributor-level accounts.

Recommendation

  • Update the Eventin WordPress plugin to the latest version immediately to remediate the vulnerability associated with CVE-2026-15667.
  • Audit WordPress user roles and capabilities to identify accounts with the 'etn_manage_event' capability and restrict these to trusted administrators only.
  • Implement file integrity monitoring to detect the creation of unexpected or unauthorized .php files on the web server filesystem.
  • Restrict file upload directories to prevent execution (e.g., set 'noexec' flags on uploads directories) as a defense-in-depth measure.
]]>highadvisorylfivulnerabilitywordpresswebserver