{"id":"CVE-2026-84898","title":"The Eventin  WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files.","summary":"The Eventin  WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files.","severity":"medium","cvss":6.6,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-22"],"published":"2026-09-05","updated":"2026-09-08","sourceUpdated":"2026-09-08T19:09:21.310","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84898","references":[{"url":"https://wpscan.com/vulnerability/d8dea263-5676-4e3c-9ea4-36904e1ac4d3/","label":"contact@wpscan.com"}],"tags":["nvd"],"epss":0.00279,"epssPercentile":0.20653,"ingestedAt":"2026-09-06T06:51:17.517Z","slug":"CVE-2026-84898","body":"## Overview\n\nThe Eventin  WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":36.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":8288,"id":"CVE-2026-84898","ts":1788919996117,"field":"cvss","old":null,"new":"6.6"},{"seq":8287,"id":"CVE-2026-84898","ts":1788919996117,"field":"severity","old":"none","new":"medium"},{"seq":8097,"id":"CVE-2026-84898","ts":1788919281563,"field":"cvss","old":"6.6","new":null},{"seq":8096,"id":"CVE-2026-84898","ts":1788919281563,"field":"severity","old":"medium","new":"none"},{"seq":7906,"id":"CVE-2026-84898","ts":1788916357332,"field":"cvss","old":null,"new":"6.6"},{"seq":7905,"id":"CVE-2026-84898","ts":1788916357332,"field":"severity","old":"none","new":"medium"},{"seq":7715,"id":"CVE-2026-84898","ts":1788915298730,"field":"cvss","old":"6.6","new":null},{"seq":7714,"id":"CVE-2026-84898","ts":1788915298730,"field":"severity","old":"medium","new":"none"},{"seq":7524,"id":"CVE-2026-84898","ts":1788912717847,"field":"cvss","old":null,"new":"6.6"},{"seq":7523,"id":"CVE-2026-84898","ts":1788912717847,"field":"severity","old":"none","new":"medium"},{"seq":7333,"id":"CVE-2026-84898","ts":1788911331894,"field":"cvss","old":"6.6","new":null},{"seq":7332,"id":"CVE-2026-84898","ts":1788911331894,"field":"severity","old":"medium","new":"none"},{"seq":7137,"id":"CVE-2026-84898","ts":1788909079456,"field":"cvss","old":null,"new":"6.6"},{"seq":7136,"id":"CVE-2026-84898","ts":1788909079456,"field":"severity","old":"none","new":"medium"},{"seq":6949,"id":"CVE-2026-84898","ts":1788907391950,"field":"cvss","old":"6.6","new":null},{"seq":6948,"id":"CVE-2026-84898","ts":1788907391950,"field":"severity","old":"medium","new":"none"},{"seq":6751,"id":"CVE-2026-84898","ts":1788905445315,"field":"cvss","old":null,"new":"6.6"},{"seq":6750,"id":"CVE-2026-84898","ts":1788905445315,"field":"severity","old":"none","new":"medium"},{"seq":6569,"id":"CVE-2026-84898","ts":1788903460168,"field":"cvss","old":"6.6","new":null},{"seq":6568,"id":"CVE-2026-84898","ts":1788903460168,"field":"severity","old":"medium","new":"none"},{"seq":6355,"id":"CVE-2026-84898","ts":1788901811362,"field":"cvss","old":null,"new":"6.6"},{"seq":6354,"id":"CVE-2026-84898","ts":1788901811362,"field":"severity","old":"none","new":"medium"},{"seq":6185,"id":"CVE-2026-84898","ts":1788899562538,"field":"cvss","old":"6.6","new":null},{"seq":6184,"id":"CVE-2026-84898","ts":1788899562538,"field":"severity","old":"medium","new":"none"},{"seq":6053,"id":"CVE-2026-84898","ts":1788898240560,"field":"cvss","old":null,"new":"6.6"},{"seq":6052,"id":"CVE-2026-84898","ts":1788898240560,"field":"severity","old":"none","new":"medium"}]}