CVE-2025-7813 is a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) affecting the Eventin WordPress plugin (Event Calendar, Event Registration, Tickets & Booking AI Powered) in all versions up to 4.0.37. The vulnerability exists in the proxy_image function, which can be abused by unauthenticated attackers to induce the server to make HTTP requests to arbitrary locations, including internal network resources. This can lead to unauthorized information disclosure and modification of internal services. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality and integrity but not availability.

An attacker can exploit this SSRF vulnerability to make the vulnerable server perform arbitrary HTTP requests, potentially accessing or modifying internal services that are not directly reachable from the internet. This can lead to partial compromise of confidentiality and integrity of internal data or services. There is no indication of availability impact. The vulnerability affects all versions up to 4.0.37 of the Eventin plugin. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider disabling or restricting access to the vulnerable proxy_image function or the plugin itself if feasible. Avoid exposing internal services that could be targeted via SSRF. Do not rely on generic mitigations; follow vendor guidance once available.