CVE-2026-13039

The Eventin plugin for WordPress contains a flaw that allows unauthorized users to complete unpaid ticket orders, effectively gaining access to paid events, tickets, and order confirmations, without making a legitimate payment. This is due to the plugin's failure to properly verify user authorization in the PaymentController's payment_complete function, allowing attackers to exploit this by submitting fake checkout or cart IDs. The vulnerability is present in versions 4.0.26 through 4.1.15, and is made worse by the fact that the necessary nonce is publicly accessible on event pages, eliminating the need for any WordPress credentials. This issue is a regression of a previously patched function and endpoint, which had been fixed but not sustained in subsequent releases.

Based on public CVE data (MITRE/NVD).