WordPress security changelog
MEDIUM CVE-2026-12956 Deferred

Eventin permits unauthenticated forged orders that exhaust ticket inventory

Eventin through 4.1.22 checks only a wp_rest nonce in create_item_permissions_check() for /wp-json/eventin/v2/orders, while exposing that nonce to visitors through the etn-public script's localized_data_obj. create_item() accepts a caller-supplied status through prepare_item_for_database() without a whitelist. An unauthenticated attacker can create completed etn-order posts counted as sold by etn_get_sold_tickets_by_event(). Cleanup is scheduled only for pending orders, so the forged completed orders persist and exhaust ticket inventory.

CVE / CNA score 5.3 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce
Plugin slug
wp-event-solution
Affected
<= 4.1.22
Safe version
4.1.24
Published
Sep 09, 2026
Weakness
CWE-862 — Missing Authorization

This CVE was published Sep 09, 2026 and is one of 45 known issues for this plugin.

What to do

Update, patch or deactivate.

The official author release notes confirm remediation by 4.1.24; this does not establish that every intervening release was affected. Update the affected edition to 4.1.24 or a later maintained release on its supported branch. If in doubt, contact Fused or your hosting vendor. Official author release notes: https://wordpress.org/plugins/wp-event-solution/.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the create_item() handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's create_item_permissions_check() function only verifies a wp_rest nonce (which is leaked to every visitor through the etn-public script's localized_data_obj on every frontend page) and accepts a user-supplied 'status' value in prepare_item_for_database() with no whitelist validation. This makes it possible for unauthenticated attackers to create etn-order posts with status='completed' that are counted as sold by etn_get_sold_tickets_by_event(); because the auto-cleanup wp_schedule_single_event() in create_item() only fires for status='pending' orders, the forged completed orders persist indefinitely and exhaust ticket inventory.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

Primary and upstream sources