Event Manager, Events Calendar, Booking, Registrations and Tickets – Eventin <= 4.0.37 - Falsificación de Solicitud Remota del Servidor No Autenticada

The SSRF vulnerability in Eventin allows an attacker to craft malicious requests that appear to originate from the plugin itself. This can be exploited to query internal services that are not directly accessible from the outside world. For example, an attacker could attempt to access administrative interfaces, database servers, or other sensitive resources within the WordPress environment. Successful exploitation could lead to data breaches, unauthorized access, and potentially even complete compromise of the web server. The lack of authentication required for exploitation significantly increases the attack surface and potential impact.

Websites utilizing the Eventin plugin for event management, particularly those with internal services accessible from the web server, are at risk. Shared hosting environments where multiple WordPress sites share the same server are also at increased risk, as a compromise of one site could potentially lead to the compromise of others.

• wordpress / composer / npm:

grep -r 'proxy_image' /var/www/html/wp-content/plugins/eventin/

• generic web:

curl -I <wordpress_site_url>/wp-content/plugins/eventin/proxy_image?url=http://localhost:8080  # Check for internal resource access

1. 2025-08-23Disclosure

   disclosure

1. Reservado2025-07-18
2. Publicada2025-08-23
3. Modificada2026-04-08
4. EPSS actualizado2026-03-23

The primary mitigation for CVE-2025-7813 is to immediately upgrade the Eventin plugin to a version containing the fix. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to block outbound requests to potentially sensitive internal resources. Additionally, restrict network access to the WordPress server to only necessary ports and services. Monitor WordPress logs for unusual outbound requests originating from the Eventin plugin, specifically looking for requests to internal IP addresses or unusual domains. A YARA rule could be created to detect the vulnerable proxy_image function in the plugin’s codebase.

Instalaciones activas

10KConocido

Valoración del plugin