SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-84898

MEDIUM · CVSS 6.6 EPSS 0.28%

Source: NVD + CISA KEV + EPSS · Published 2026-09-05 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

The Eventin WordPress plugin prior to version 4.1.21 is vulnerable to local file inclusion due to inadequate validation of template path values, enabling users with contributor-level access or higher to execute arbitrary PHP files on the server. This vulnerability poses a significant risk as it could lead to remote code execution and potential site compromise. WordPress site administrators and developers using this plugin should prioritize immediate updates to mitigate the risk.

CVE
CVE-2026-84898
Severity
MEDIUM
CVSS
6.6
EPSS
0.28%
WordPress

Original NVD Description

The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files.