Is CVE-2026-15398 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15398 being exploited in the wild.

How severe is CVE-2026-15398?

Medium severity, with a CVSS score of 4.3, published 9 September 2026.

Which products and versions are affected?

Eventin Event Calendar, Event Registration, Tickets & Booking (AI Powered) up to and including 4.1.22.

Is there a fix for CVE-2026-15398?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15398 attacked?

It is attacked over the network.

Am I affected by CVE-2026-15398?

Check whether you run Eventin Event Calendar, Event Registration or Tickets & Booking (AI Powered) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15398: WordPress Eventin plugin authorization bypass in order management

CVE-2026-15398 · Severity: medium · CVSS 4.3 · Published 2026-09-09

The Eventin WordPress plugin, used for event management and ticketing, fails to properly verify user permissions when processing event orders. An attacker can bypass payment requirements, fraudulently complete orders, deplete ticket inventory, and send fake confirmation emails—all without making a legitimate purchase. The vulnerability is exploitable even without an account because WordPress emits authentication tokens on public pages.

Vendors: Eventin.

Quick answers

Is CVE-2026-15398 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15398 being exploited in the wild.
How severe is CVE-2026-15398?: Medium severity, with a CVSS score of 4.3, published 9 September 2026.
Which products and versions are affected?: Eventin Event Calendar, Event Registration, Tickets & Booking (AI Powered) up to and including 4.1.22.
Is there a fix for CVE-2026-15398?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15398 attacked?: It is attacked over the network.
Am I affected by CVE-2026-15398?: Check whether you run Eventin Event Calendar, Event Registration or Tickets & Booking (AI Powered) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass (CWE-639) in the order creation and update endpoints of the Eventin plugin. The plugin fails to properly verify user authorization before allowing actions like marking orders as completed or updating booking status. The attack vector combines a publicly exposed wp_rest nonce (emitted on frontend pages) with an order creation endpoint that issues an order_access_token without proper validation, granting unauthenticated attackers the credentials needed to reach privileged functions like update_booking_status. Authenticated subscribers and above are also affected. The plugin versions up to and including 4.1.22 are vulnerable.

Affected products

Eventin Event Calendar, Event Registration, Tickets & Booking (AI Powered) up to and including 4.1.22

Timeline

2026-09-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.