CVE-2026-13177
The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-l
CVSS
—
No CVSS
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Aug 12, 2026 · Last modified: Aug 12, 2026
Not enough EPSS history yet.
The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers.
No related CVEs by CWE or product.