CVE-2026-15406

Eventin, a WordPress event calendar, registration and ticketing plugin, is vulnerable to a local file inclusion (LFI, CWE-98) flaw affecting all versions up to and including 4.1.22, triggered through the 'event_layout' parameter. An authenticated attacker with at least custom-level (low-privilege) access can manipulate this parameter to make the server include and execute arbitrary .php files resident on the host. Successful exploitation can bypass access controls, expose sensitive data, or achieve code execution when an attacker can upload a malicious .php file and have it included. All sites running Eventin 4.1.22 or earlier are affected, though the authentication requirement limits the attack surface to sites granting write/access roles to less-trusted users. As of publication there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns only a 0.7% probability of exploitation within 30 days, so no in-the-wild exploitation is known.

What to do: Update Eventin to the latest release (any version after 4.1.22) as soon as possible. Until patched, restrict uploading of .php files to the site and audit which accounts with custom-level or other low-privilege roles have access, as those are the accounts that can trigger the flaw. Administrators should also review upload directories for unexpected or recently added .php files that could be used as inclusion targets.