What is GHSA-fpv5-766g-3798?

GHSA-fpv5-766g-3798 is a security advisory published by GitHub Security Advisories with Medium severity. The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by...

Which CVE IDs does GHSA-fpv5-766g-3798 cover?

GHSA-fpv5-766g-3798 covers the following CVE IDs: CVE-2026-13172. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fpv5-766g-3798?

GHSA-fpv5-766g-3798 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-fpv5-766g-3798MediumCVSS 5.3

The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by...

Vendor

GitHub Security Advisories

Published

August 26, 2026

Last Modified

August 26, 2026

🔗 CVE IDs covered (1)

CVE-2026-13172 →

📋 Description

The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces, allowing unauthenticated users to retrieve draft, pending and private posts belonging to other users, along with the passwords and contents of password-protected ones.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-13172
https://wpscan.com/vulnerability/1b2d4b55-1b7e-4150-8f90-492f7a3d5400
https://github.com/advisories/GHSA-fpv5-766g-3798