The Eventin WordPress plugin versions prior to 4.1.21 contain a server-side request forgery (SSRF) vulnerability (CWE-918) due to lack of validation of user-supplied webhook URLs and absence of event ownership verification. This flaw permits users with contributor-level privileges or higher to cause the server to make HTTP requests to arbitrary external hosts without user interface interaction. The vulnerability is classified as low severity with a CVSS 3.1 base score of 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N). No official remediation level or patch information is provided in the source data.

An attacker with contributor-level or higher access can exploit this vulnerability to make the server perform blind HTTP requests to arbitrary hosts. This could potentially be used for internal network scanning or accessing internal resources not otherwise reachable. The impact is limited to low confidentiality loss; there is no direct impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and monitor for unusual webhook URL configurations. Avoid exposing sensitive internal resources that could be targeted via SSRF.