CVE-2026-13039

Received Received - Intake

Authorization Bypass in Eventin WordPress Plugin

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: Wordfence

Description

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This is due to the plugin not properly verifying that a user is authorized to perform an action in the payment_complete() function of PaymentController.php. This makes it possible for unauthenticated attackers to mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash, granting themselves paid event access, QR-code attendee tickets, and order confirmation emails without making any real payment. The wp_rest nonce required to reach the vulnerable endpoint is embedded in every public event page, meaning no WordPress session or credentials are needed to obtain it. This vulnerability represents a regression — the same function and endpoint were previously patched but the fix did not persist through subsequent releases.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-10

Last Modified

2026-07-10

Generated

2026-07-11

AI Q&A

2026-07-11

EPSS Evaluated

N/A

NVD

CVE-2026-13039

Affected Vendors & Products

Vendor	Product	Version / Range
eventin	event_calendar	From 4.0.26 (inc) to 4.1.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress has a vulnerability due to an authorization bypass in versions 4.0.26 through 4.1.15. Specifically, the plugin does not properly verify if a user is authorized to perform certain actions in the payment_complete() function of PaymentController.php.

This flaw allows unauthenticated attackers to mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash. Because the wp_rest nonce needed to access the vulnerable endpoint is embedded in every public event page, attackers do not need a WordPress session or credentials to exploit this.

As a result, attackers can grant themselves paid event access, QR-code attendee tickets, and order confirmation emails without making any real payment. This vulnerability is a regression, meaning a previous fix was undone in later versions.

Impact Analysis

This vulnerability can allow attackers to gain unauthorized access to paid events without paying. They can mark unpaid ticket orders as completed, obtain QR-code attendee tickets, and receive order confirmation emails fraudulently.

This can lead to financial losses for event organizers, as attackers bypass payment. It may also cause issues with event capacity and attendee management since unauthorized users can attend events.

Mitigation Strategies

To mitigate this vulnerability, you should update the Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress to a version later than 4.1.15 where the authorization bypass issue in the payment_complete() function is fixed.

Since the vulnerability allows unauthenticated attackers to mark unpaid ticket orders as completed, it is critical to ensure that your plugin version is not within the vulnerable range (4.0.26 up to and including 4.1.15).

Additionally, monitor your event ticket orders for any suspicious completed orders that were not paid for, and consider temporarily disabling the plugin or the affected functionality until an update is applied.

Hi! I’m here to help you understand CVE-2026-13039. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70