CVE-2026-15667: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce

CVE-2026-15667 is a Local File Inclusion vulnerability in the Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce WordPress plugin. It arises from improper control of the filename used in an include/require statement, specifically via the 'event_layout' parameter. Authenticated attackers with contributor-level privileges or higher can manipulate this parameter through the REST API to include arbitrary PHP files, leading to remote code execution. The vulnerability is due to the etn_manage_event capability being assigned to Contributors by default, facilitating exploitation without privilege escalation. No official patch or remediation guidance has been published yet.

Successful exploitation allows authenticated contributors or higher to execute arbitrary PHP code on the server, potentially bypassing access controls and accessing sensitive data. This can lead to full compromise of the affected WordPress site, including code execution and data exposure. The vulnerability is rated high severity with a CVSS score of 7.5, reflecting network attack vector, low privileges required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level user access and review capability assignments to prevent unauthorized use of the etn_manage_event capability. Monitor for updates from the vendor or security advisories to apply official patches once released.