The Eventin plugin for WordPress contains an SSRF vulnerability in the proxy_image function that allows unauthenticated attackers to trigger web requests from the application to arbitrary URLs. This can expose internal resources or modify data on services reachable from the host, potentially leaking sensitive information or enabling further attacks such as credential compromise or denial of service. The weakness is classified as CWE‑918.

The vulnerability affects the Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin version 4.0.37 and all earlier releases. The plugin is distributed by arraytics and installed via the WordPress plugin repository.

The CVSS score of 7.2 categorizes the issue as a high‑severity risk. The EPSS score of less than 1% indicates that exploitation is considered unlikely at present, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers would leverage the public proxy_image endpoint to issue requests to internal IPs or service endpoints, making the threat most relevant in environments where the WordPress site can reach sensitive internal services.