CVE-2026-13169

The Eventin WordPress plugin before 4.1.21 suffers from an IDOR flaw: contributor-level users can modify, delete, or reassign events created by others, including administrators, due to missing ownership verification. This grants unauthorized integrity and confidentiality control over event data. ...