Is CVE-2026-13178 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13178 being exploited in the wild.

How severe is CVE-2026-13178?

Informational severity, with a CVSS score of 7.5, published 30 July 2026.

Which products and versions are affected?

wp-event-solution Eventin < 4.1.16.

Is there a fix for CVE-2026-13178?

A patch was published on 2026-07-13: Fixed in version 4.1.16 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-13178 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-13178?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13178: Eventin WordPress plugin payment bypass via order status manipulation

Q: Is there a fix for CVE-2026-13178?

A patch was published on 2026-07-13: Fixed in version 4.1.16 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-13178 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-13178?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13178 · Severity: info · CVSS 7.5 · Published 2026-07-30

Eventin is a WordPress plugin used for managing events and selling tickets. A security flaw in the plugin allows unauthorized users to create event ticket orders and manually set them as 'paid' without actually completing a transaction. This could lead to significant financial loss as attackers can obtain tickets for free, bypassing the payment gateway entirely.

Quick answers

Is CVE-2026-13178 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13178 being exploited in the wild.
How severe is CVE-2026-13178?: Informational severity, with a CVSS score of 7.5, published 30 July 2026.
Which products and versions are affected?: wp-event-solution Eventin < 4.1.16.
Is there a fix for CVE-2026-13178?: A patch was published on 2026-07-13: Fixed in version 4.1.16 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13178 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-13178?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Eventin plugin's REST API endpoint (/wp-json/eventin/v2/orders) fails to implement proper authorization checks and input validation on the 'status' field during order creation. An unauthenticated attacker can send a POST request to this endpoint with a valid REST nonce (which is easily obtainable) and specify a status of 'completed'. Because the plugin accepts this attacker-supplied status without verifying payment through a gateway, the system treats the order as successfully paid. This is classified as an Insecure Direct Object Reference (IDOR) / Broken Access Control vulnerability. The issue is resolved in version 4.1.16.

Affected products

wp-event-solution Eventin < 4.1.16

Timeline

2026-07-13: disclosed: Publicly published by WPScan
2026-07-13: patched: Fixed in version 4.1.16
2026-07-30: advisory: NVD publication date

References

https://wpscan.com/vulnerability/09d6135f-b38c-4cfe-8a9f-5d79552c720c/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.