Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.26 - Unauthenticated Payment Bypass via WooCommerce Order Linking
- ID
- WPSEC-2026-1150
- Plugin
- Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce (wp-event-solution)
- Affected
- all versions before 4.1.27
- Remediation
- Update to 4.1.27 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-840
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-16
- Attack surface
- Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to a payment bypass via the WooCommerce checkout integration in all versions up to, and including, 4.1.26, due to the plugin trusting the 'event_order_id' session marker when it links a new WooCommerce order to an Eventin ticket order, without checking that the WooCommerce order contains that ticket or covers its price. The marker is not cleared when the whole cart is emptied. This makes it possible for unauthenticated attackers to link a free or low-cost WooCommerce order to a pending paid Eventin ticket order and have the booking marked completed without paying for it.
References
- https://wpsec.com/vuln/WPSEC-2026-1150/
- https://plugins.svn.wordpress.org/wp-event-solution/tags/4.1.27/
- https://wordpress.org/plugins/wp-event-solution/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS