Description

The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-08-21T12:16:22.140Z",
  "pubdate": "2026-08-21T12:16:22.140Z",
  "executiveSummary": "An authenticated Blind Server-Side Request Forgery vulnerability exists within the Eventin WordPress plugin prior to version 4.1.21. The flaw stems from insufficient validation of user-supplied webhook URLs stored on events and a lack of proper authorization checks to verify event ownership.\nAuthenticated attackers possessing contributor-level access or higher can exploit this deficiency to force the underlying WordPress server to dispatch outbound HTTP requests to arbitrary, internal or external network locations.\nThis behavior exposes internal network topologies, facilitates unauthorized interaction with internal microservices, and enables potential pivoting against restricted network perimeters behind the web application firewall. Exploitation requires authenticated access with a minimum privilege level of contributor within the WordPress environment, bypassing intended functional constraints to induce blind server-side request forgery conditions.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of input sanitization, strict URL schema validation, and proper access control enforcement within the event management and webhook triggering functionality of the Eventin plugin. Specifically, the application permits users to supply and store arbitrary webhook URLs associated with events without validating whether the target destination resolves to public or private IP spaces, nor does it confirm if the user modifying or triggering the event holds administrative ownership over the specified resource.\nAttack flow begins when an authenticated malicious actor with contributor-level privileges or higher interacts with the event configuration interface. The attacker creates or modifies an event entry, inserting a maliciously crafted webhook URL pointing to an arbitrary host, such as an internal metadata service, private subnet address, or external destination under the attacker's control. Upon triggering the event mechanism, the server-side application reads the stored webhook URL and initiates an outbound HTTP request to the designated target.\nBecause the application fails to validate the destination URL, it is susceptible to Server-Side Request Forgery (SSRF). The exploitation is characterized as blind SSRF, meaning the direct response body from the targeted internal or external service is typically not returned to the attacker's browser interface, but the server nevertheless performs the network interaction. This capability allows attackers to probe internal network perimeters, interact with loopback interfaces, bypass firewall restrictions, and potentially trigger unintended actions on internal APIs that accept HTTP GET or POST requests.\nThe vulnerable component resides within the event processing and webhook dispatching logic of the Eventin WordPress plugin affecting all versions prior to 4.1.21. Network exposure is inherent to the web application handling HTTP requests, while authentication and privilege requirements necessitate at least a contributor-level account on the WordPress installation."
}