{"id":"CVE-2026-13169","aliases":["EUVD-2026-62258","GHSA-f556-jv65-29j9"],"status":"published","title":"Eventin \u003c 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDOR","description":"The Eventin  WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including administrators.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.0035,"percentile":0.28881,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2026-08-19T06:00:14Z","modified":"2026-10-22T16:09:59Z","products":[{"vendor":"arraytics","product":"eventin"},{"vendor":"unknown","product":"eventin"}],"references":[{"url":"https://wpscan.com/vulnerability/cf2b1152-7190-467b-a860-1f7bd806575d/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13169"},{"url":"https://wpscan.com/vulnerability/cf2b1152-7190-467b-a860-1f7bd806575d"},{"url":"https://github.com/advisories/GHSA-f556-jv65-29j9"}],"sources":{"cve":[{"id":"CVE-2026-13169","title":"Eventin \u003c 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDOR","description":"The Eventin  WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including administrators.","status":"published","published":"2026-08-19T06:00:14.21Z","modified":"2026-08-19T12:54:29.588Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:19:49.885652Z"}],"euvd":[{"id":"EUVD-2026-62258","description":"The Eventin  WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including administrators.","status":"published","published":"2026-08-19T06:00:14Z","modified":"2026-08-19T12:54:29Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:45.709762Z"}],"ghsa":[{"id":"GHSA-f556-jv65-29j9","title":"The Eventin  WordPress plugin before 4.1.21 does not properly verify ownership of events before...","description":"The Eventin  WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including administrators.","status":"published","published":"2026-08-19T06:31:17Z","modified":"2026-08-19T15:33:23Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:10:40.42434Z"}],"nvd":[{"id":"CVE-2026-13169","description":"The Eventin  WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including administrators.","status":"published","published":"2026-08-19T06:17:31.677Z","modified":"2026-10-22T16:09:59.56Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:12:39.620837Z"}]}}