CVE-2026-15398
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The Eventin plugin for WordPress up to version 4.1.22 has an authorization bypass vulnerability. Authenticated attackers with subscriber-level access can bypass payment for paid events, fraudulently mark orders as completed, deplete ticket inventory, and trigger confirmation emails for tickets never purchased. It is also exploitable by unauthenticated attackers because the wp_rest nonce is publicly emitted on every frontend page, and the order creation endpoint mints and returns an order_access_token to any caller possessing that nonce.
Risk Assessment
The organization may suffer financial losses due to unauthorized access to paid events and order manipulation. Ticket inventory depletion and fake confirmation emails can also undermine customer trust.
Recommendation
Immediately update the Eventin plugin to the latest version that fixes this vulnerability. Also restrict access to REST endpoints and monitor for unusual order-related activities.
Other vulnerabilities in Eventin
See all- CVE-2026-84907Low
The Eventin WordPress plugin before 4.1.24 does not properly authorize order finalisation when its offline (local) payment method is enabled, relying on a nonce that is exposed to unauthenticated visitors and never checking that the caller owns the order. This allows unauthenticated attackers to reset any existing order and its attendees to a pending state and thereby invalidate paid tickets.
- CVE-2026-84905Low
The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker. This allows users with contributor-level access and above to create new WordPress user accounts that carry capabilities beyond their own, including publishing content and uploading files, and, by supplying an email address they control, to obtain a working login to the created account.
- CVE-2026-77702Medium
The Eventin plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge.
- CVE-2026-11821Medium
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view, create, update, clone, and delete notification flow event automation workflows that should be restricted to administrators.
- CVE-2026-15667High
The Eventin plugin for WordPress (up to version 4.1.22) is vulnerable to Local File Inclusion via the 'event_layout' parameter. Authenticated attackers with contributor-level access or above can include and execute arbitrary .php files on the server. The etn_manage_event capability is assigned to Contributors by default, meaning any Contributor-level user can set the malicious event_layout value via the REST API without any additional configuration.
- CVE-2026-15406High
The Eventin plugin for WordPress (up to version 4.1.22) is vulnerable to Local File Inclusion via the 'event_layout' parameter. Authenticated attackers with custom-level access or above can include and execute arbitrary .php files on the server, potentially leading to bypassing access controls, obtaining sensitive data, or code execution if .php files can be uploaded and included.
- CVE-2026-84901Medium
The Eventin WordPress plugin before version 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event and speaker taxonomy terms they should not be able to manage.
- CVE-2026-84898Medium
The Eventin WordPress plugin before version 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files.
- CVE-2026-77694Medium
The Eventin WordPress plugin before version 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order. This allows unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken.
- CVE-2026-13172Medium
The Eventin WordPress plugin before version 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces. This allows unauthenticated users to retrieve draft, pending and private posts belonging to other users, along with the passwords and contents of password-protected ones.
Original NVD description (English source)
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.22. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to bypass payment for paid events, fraudulently mark orders as completed, deplete ticket inventory, and trigger confirmation emails for tickets never purchased. This is exploitable by unauthenticated attackers because the wp_rest nonce is publicly emitted on every frontend page, and the order creation endpoint mints and returns an order_access_token to any caller possessing that nonce — giving unauthenticated users all credentials required to reach the privileged update_booking_status branch.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS