The Eventin WordPress plugin, in versions earlier than 4.1.21, accepts a webhook URL supplied by a user and does not validate the value or verify that the user is the owner of the event. This flaw allows anyone with contributor level or higher within the WordPress site to trigger blind server‑side requests to arbitrary hosts via the webhook mechanism, potentially causing unintended network traffic or exposing internal resources to external observers.

This vulnerability affects the Eventin WordPress plugin before version 4.1.21. No additional version details or vendor markings are supplied; the plugin is identified only as Eventin for WordPress.

The CVSS score of 2.7 places this issue in the low severity range, and the EPSS score is not available. Because this flaw requires the attacker to have contributor‑level access on the site, it is unlikely that public attackers can exploit it without first compromising the account. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation is known. Nonetheless, an attacker with legitimate contributor privilege could generate arbitrary outbound HTTP/S requests, which may lead to information disclosure or denial of service against target hosts.