CVE-2026-13178
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status. Unauthenticated users can create orders marked as paid without completing any payment.
Risk Assessment
An attacker can falsely mark orders as paid, leading to financial loss and unauthorized access to paid content or services.
Recommendation
Update the Eventin plugin to version 4.1.16 or later.
Other vulnerabilities in Eventin
See all- CVE-2026-77694Medium
The Eventin WordPress plugin before version 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order. This allows unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken.
- CVE-2026-13172Medium
The Eventin WordPress plugin before version 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces. This allows unauthenticated users to retrieve draft, pending and private posts belonging to other users, along with the passwords and contents of password-protected ones.
- CVE-2026-13176Low
The Eventin WordPress plugin before version 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts.
- CVE-2026-13177Medium
The Eventin WordPress plugin before version 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers.
- CVE-2026-13171High
The Eventin WordPress plugin before version 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records.
- CVE-2026-13168Medium
The Eventin WordPress plugin before version 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses.
- CVE-2026-13039Medium
The Eventin plugin for WordPress (versions 4.0.26 to 4.1.15) has an authorization bypass vulnerability in the payment_complete() function of PaymentController.php. Unauthenticated attackers can mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash, gaining paid event access, QR-code tickets, and confirmation emails without any payment.
- CVE-2026-12924Medium
The Eventin plugin for WordPress (versions up to and including 4.1.15) is vulnerable to stored XSS via the 'etn_faq_content' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute whenever a user visits an affected page.
Original NVD description (English source)
The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment.