CVE-2026-13177

The Eventin WordPress plugin (versions prior to 4.1.20 ) is vulnerable to an IDOR (Insecure Direct Object Reference) vulnerability. The software fails to properly restrict access to individual order records, which allows users with contributor-level access or higher to read other customers' order...