# CVE-2026-12956: WP Event Solution Eventin missing authorization in orders REST endpoint

Source: https://junglewise.ai/threats/cve-2026-12956-wp-event-solution-eventin-missing-authorization-in-orders-rest  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-12956 · Severity: medium · CVSS 5.3 · Published 2026-09-09

The WP Event Solution (Eventin) plugin for WordPress provides event management and ticket sales functionality. An unauthenticated attacker can exploit a flaw in the orders REST API to forge fake "completed" ticket sales, artificially exhausting event ticket inventory and disrupting legitimate ticket purchases. This could lead to customer complaints, lost revenue, and reputational damage.

Technologies: [WP Event Solution Eventin](https://junglewise.ai/threats/technologies/eventin). Vendors: [WP Event Solution](https://junglewise.ai/threats/vendors/wp-event-solution).

## Quick answers

**Is CVE-2026-12956 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12956 being exploited in the wild.

**How severe is CVE-2026-12956?** Medium severity, with a CVSS score of 5.3, published 9 September 2026.

**Which products and versions are affected?** WP Event Solution Eventin up to and including 4.1.22.

**Is there a fix for CVE-2026-12956?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12956 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-12956?** Check whether you run WP Event Solution Eventin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authorization flaw in the create_item() handler of the /wp-json/eventin/v2/orders REST endpoint. The create_item_permissions_check() function relies solely on a wp_rest nonce that is publicly leaked in the etn-public script's localized data, providing no genuine authentication. Additionally, prepare_item_for_database() accepts a user-supplied 'status' parameter without whitelist validation, allowing attackers to create etn-order posts with status='completed'. Unlike pending orders (which are auto-cleaned up via wp_schedule_single_event()), completed orders persist indefinitely and are counted as sold by etn_get_sold_tickets_by_event(), allowing attackers to exhaust ticket inventory without authentication or user interaction.

## Affected products

- WP Event Solution Eventin up to and including 4.1.22

## Timeline

- 2026-09-09: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/Order/OrderController.php](https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/Order/OrderController.php)
- [https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/Order/OrderController.php](https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/Order/OrderController.php)

## Related threats

- [WordPress Eventin plugin unauthorized customer data disclosure](https://junglewise.ai/threats/cve-2026-13168-wordpress-eventin-plugin-unauthorized-customer-data-disclosure)
- [WP Event Solution Eventin broken access control](https://junglewise.ai/threats/cve-2026-40776-wp-event-solution-eventin-broken-access-control)