CVE-2025-49869

The Eventin WordPress plugin contains a vulnerability that allows attackers with contributor-level access and above to inject malicious PHP objects through untrusted input deserialization in versions up to 4.0.31. This flaw can be exploited by an attacker who has the necessary permissions to introduce arbitrary data into the system, potentially leading to severe consequences such as file deletion or sensitive information retrieval.

Based on public CVE data (MITRE/NVD).