Executive brief
The Eventin WordPress plugin, used for event management and ticketing, fails to properly verify user permissions when processing event orders. An attacker can bypass payment requirements, fraudulently complete orders, deplete ticket inventory, and send fake confirmation emails—all without making a legitimate purchase. The vulnerability is exploitable even without an account because WordPress emits authentication tokens on public pages.
Technical details
The vulnerability is an authorization bypass (CWE-639) in the order creation and update endpoints of the Eventin plugin. The plugin fails to properly verify user authorization before allowing actions like marking orders as completed or updating booking status. The attack vector combines a publicly exposed wp_rest nonce (emitted on frontend pages) with an order creation endpoint that issues an order_access_token without proper validation, granting unauthenticated attackers the credentials needed to reach privileged functions like update_booking_status. Authenticated subscribers and above are also affected. The plugin versions up to and including 4.1.22 are vulnerable.
Affected products
- Eventin Event Calendar, Event Registration, Tickets & Booking (AI Powered) up to and including 4.1.22
Timeline
- 2026-09-09: disclosed