CVE-2026-13039
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The Eventin plugin for WordPress (versions 4.0.26 to 4.1.15) has an authorization bypass vulnerability in the payment_complete() function of PaymentController.php. Unauthenticated attackers can mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash, gaining paid event access, QR-code tickets, and confirmation emails without any payment.
Risk Assessment
The organization faces financial loss and compromised event registration integrity – unauthorized users can access paid events and tickets, undermining trust and potentially leaking attendee data.
Recommendation
Immediately update the Eventin plugin to a version newer than 4.1.15 where the vulnerability is patched. If no update is available, temporarily disable the REST endpoint for payment_complete() or apply WAF rules to block suspicious requests.
Other vulnerabilities in Eventin
See all- CVE-2026-77694Medium
The Eventin WordPress plugin before version 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order. This allows unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken.
- CVE-2026-13172Medium
The Eventin WordPress plugin before version 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces. This allows unauthenticated users to retrieve draft, pending and private posts belonging to other users, along with the passwords and contents of password-protected ones.
- CVE-2026-13176Low
The Eventin WordPress plugin before version 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts.
- CVE-2026-13177Medium
The Eventin WordPress plugin before version 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers.
- CVE-2026-13171High
The Eventin WordPress plugin before version 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records.
- CVE-2026-13168Medium
The Eventin WordPress plugin before version 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses.
- CVE-2026-13178High
The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status. Unauthenticated users can create orders marked as paid without completing any payment.
- CVE-2026-12924Medium
The Eventin plugin for WordPress (versions up to and including 4.1.15) is vulnerable to stored XSS via the 'etn_faq_content' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute whenever a user visits an affected page.
Original NVD description (English source)
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This is due to the plugin not properly verifying that a user is authorized to perform an action in the payment_complete() function of PaymentController.php. This makes it possible for unauthenticated attackers to mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash, granting themselves paid event access, QR-code attendee tickets, and order confirmation emails without making any real payment. The wp_rest nonce required to reach the vulnerable endpoint is embedded in every public event page, meaning no WordPress session or credentials are needed to obtain it. This vulnerability represents a regression — the same function and endpoint were previously patched but the fix did not persist through subsequent releases.