PT-2025-34519 · WordPress · Eventin

Gai Tanaka · Published 2025-08-23 · Updated 2025-08-23 · CVE-2025-7813

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Eventin plugin for WordPress versions through 4.0.37

Description: The Eventin plugin for WordPress is susceptible to Server-Side Request Forgery (SSRF) via the proxy image function. This allows unauthenticated attackers to make web requests to arbitrary locations originating from the web application, potentially enabling them to query and modify information from internal services.

Recommendations: Update the Eventin plugin to a version later than 4.0.37.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-7813

Affected Products

Eventin

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-7813 · Security Note
• https://twitter.com/VulmonFeeds/status/1959236544608210968 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3345781/wp-event-solution/tags/4.0.38/core/Admin/hooks.php · Note
• https://t.me/cveNotify/133256 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wp-event-solution/trunk/core/Admin/hooks.php#L451 · Note
• https://t.me/CVEtracker/30778 · Telegram Post
• https://twitter.com/CVEnew/status/1959147715339726872 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/a73f806d-5d64-4df5-b032-3d3a149036ff?source=cve · Note
• https://wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-event-solution/event-manager-events-calendar-tickets-registrations-eventin-4026-unauthenticated-arbitrary-file-read · Note