Executive brief
Eventin is a WordPress plugin used for managing events and selling tickets. A security flaw in the plugin allows unauthorized users to create event ticket orders and manually set them as 'paid' without actually completing a transaction. This could lead to significant financial loss as attackers can obtain tickets for free, bypassing the payment gateway entirely.
Technical details
The Eventin plugin's REST API endpoint (/wp-json/eventin/v2/orders) fails to implement proper authorization checks and input validation on the 'status' field during order creation. An unauthenticated attacker can send a POST request to this endpoint with a valid REST nonce (which is easily obtainable) and specify a status of 'completed'. Because the plugin accepts this attacker-supplied status without verifying payment through a gateway, the system treats the order as successfully paid. This is classified as an Insecure Direct Object Reference (IDOR) / Broken Access Control vulnerability. The issue is resolved in version 4.1.16.
Affected products
- wp-event-solution Eventin < 4.1.16
Timeline
- 2026-07-13: disclosed: Publicly published by WPScan
- 2026-07-13: patched: Fixed in version 4.1.16
- 2026-07-30: advisory: NVD publication date