CVE-2026-84898

The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files.

  • Published Sep 5, 2026
  • CVSS 6.6 medium
  • 0.4% chance of exploitation in the next 30 days (EPSS)
  • A fix is available

Affected software

CVE-2026-84898 at the National Vulnerability Database