# CVE-2026-13171: Eventin WordPress plugin authorization bypass in waiting-list handler

Source: https://junglewise.ai/threats/cve-2026-13171-eventin-wordpress-plugin-authorization-bypass-in-waiting-list  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-13171 · Severity: high · CVSS 8.2 · Published 2026-08-12

The Eventin WordPress plugin for event management fails to verify user permissions on its waiting-list registration endpoint, allowing attackers to create arbitrary WordPress user accounts without authentication. This bypasses self-registration restrictions and enables account takeover, spam campaigns, or privilege escalation depending on the assigned user role and site configuration.

## Quick answers

**Is CVE-2026-13171 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13171 being exploited in the wild.

**How severe is CVE-2026-13171?** High severity, with a CVSS score of 8.2, published 12 August 2026.

**Which products and versions are affected?** Eventin Eventin before 4.1.20.

**Is there a fix for CVE-2026-13171?** A patch was published on 2026-08-12: Fixed in version 4.1.20 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-13171 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-13171?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an access control bypass (CWE-284) in the waiting-list registration endpoint (`POST /wp-json/eventin/v2/orders/waiting-list`) and a secondary variant in the guest checkout route (`POST /wp-json/eventin/v2/orders`). The waiting-list handler performs no authorization checks and accepts event_id, customer email, and attendee details directly from unauthenticated requests, creating WordPress user accounts with the `etn-customer` role regardless of the site's "Anyone can register" setting. The guest checkout variant requires only a `wp_rest` nonce, which the plugin publicly exposes in event pages, eliminating effective authentication. No prior account, cookies, or user interaction are required. Exploitation results in account creation for arbitrary email addresses and injection of order records. The vulnerability is fixed in version 4.1.20.

## Affected products

- Eventin Eventin before 4.1.20

## Timeline

- 2026-08-10: disclosed
- 2026-08-12: patched: Fixed in version 4.1.20

## References

- [https://wpscan.com/vulnerability/90240025-4dca-4bdb-9698-b63f4c60f413/](https://wpscan.com/vulnerability/90240025-4dca-4bdb-9698-b63f4c60f413/)