CVE-2026-11821

The Eventin WordPress plugin before 4.1.24 does not properly authorize order finalisation when its offline (local) payment method is enabled, relying on a nonce that is exposed to unauthenticated visitors and never checking that the caller owns the order. This allows unauthenticated attackers to reset any existing order and its attendees to a pending state and thereby invalidate paid tickets.

The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker. This allows users with contributor-level access and above to create new WordPress user accounts that carry capabilities beyond their own, including publishing content and uploading files, and, by supplying an email address they control, to obtain a working login to the created account.

The Eventin plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge.

The Eventin plugin for WordPress up to version 4.1.22 has an authorization bypass vulnerability. Authenticated attackers with subscriber-level access can bypass payment for paid events, fraudulently mark orders as completed, deplete ticket inventory, and trigger confirmation emails for tickets never purchased. It is also exploitable by unauthenticated attackers because the wp_rest nonce is publicly emitted on every frontend page, and the order creation endpoint mints and returns an order_access_token to any caller possessing that nonce.

The Eventin plugin for WordPress (up to version 4.1.22) is vulnerable to Local File Inclusion via the 'event_layout' parameter. Authenticated attackers with contributor-level access or above can include and execute arbitrary .php files on the server. The etn_manage_event capability is assigned to Contributors by default, meaning any Contributor-level user can set the malicious event_layout value via the REST API without any additional configuration.

The Eventin plugin for WordPress (up to version 4.1.22) is vulnerable to Local File Inclusion via the 'event_layout' parameter. Authenticated attackers with custom-level access or above can include and execute arbitrary .php files on the server, potentially leading to bypassing access controls, obtaining sensitive data, or code execution if .php files can be uploaded and included.

The Eventin WordPress plugin before version 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event and speaker taxonomy terms they should not be able to manage.

The Eventin WordPress plugin before version 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files.

The Eventin WordPress plugin before version 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order. This allows unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken.

The Eventin WordPress plugin before version 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces. This allows unauthenticated users to retrieve draft, pending and private posts belonging to other users, along with the passwords and contents of password-protected ones.