PatchSiren

Eventin CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review Eventin CVE published 2026-08-10

CVE-2026-13170

The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with editor-level access and above to include and execute arbitrary local PHP files. This vulnerability affects users with editor-level access and above, potentially allowing them to execute arbitrary PHP code. The plugin's failure to validate the template p [truncated]