CVE-2026-13039— WordPress Eventin 授权问题漏洞

Eventin 4.0.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This is due to the plugin not properly verifying that a user is authorized to perform an action in the payment_complete() function of PaymentController.php. This makes it possible for unauthenticated attackers to mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash, granting themselves paid event access, QR-code attendee tickets, and order confirmation emails without making any real payment. The wp_rest nonce required to reach the vulnerable endpoint is embedded in every public event page, meaning no WordPress session or credentials are needed to obtain it. This vulnerability represents a regression — the same function and endpoint were previously patched but the fix did not persist through subsequent releases.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

授权机制缺失

WordPress Eventin 授权问题漏洞

WordPress Eventin是WordPress基金会的一系列CMS组件。 WordPress Eventin 4.0.26版本至4.1.15版本存在授权问题漏洞，该漏洞源于PaymentController.php中的payment_complete()函数未正确验证用户授权，导致未经身份验证的攻击者通过提交伪造的SureCart checkout ID或FluentCart cart hash，可将未支付的票务订单标记为已完成，从而获得付费活动访问权限、QR码参与票和订单确认邮件，而无需进行实际

N/A

N/A