CVE-2026-13170 Eventin < 4.1.20 - Editor+ Local File Inclusion via speaker_template Setting

The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with editor-level access and above to include and execute arbitrary local PHP files...

CVE-2026-13170

The Eventin WordPress plugin (specifically the WP Event Solution plugin) versions prior to 4.1.20 is vulnerable to a Local File Inclusion (LFI) . The root cause is the failure to properly validate a template path setting, specifically the speaker_template setting, before using it to include a loc...