{
 "id": "WPSEC-2026-1150",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1150/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1150/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1150/index.md",
 "title": "Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.26 - Unauthenticated Payment Bypass via WooCommerce Order Linking",
 "description": "The Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to a payment bypass via the WooCommerce checkout integration in all versions up to, and including, 4.1.26, due to the plugin trusting the 'event_order_id' session marker when it links a new WooCommerce order to an Eventin ticket order, without checking that the WooCommerce order contains that ticket or covers its price. The marker is not cleared when the whole cart is emptied. This makes it possible for unauthenticated attackers to link a free or low-cost WooCommerce order to a pending paid Eventin ticket order and have the booking marked completed without paying for it.",
 "plugin": {
  "slug": "wp-event-solution",
  "name": "Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce",
  "full_name": "Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/wp-event-solution/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-event-solution/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-event-solution"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-840"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.1.27",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.1.27"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.1.27",
 "remediation": "Update to 4.1.27 or later.",
 "fix_released": "2026-10-16T03:36:03+00:00",
 "published": "2026-10-17T03:41:18+00:00",
 "updated": "2026-10-16T09:50:09.902793+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1150/",
  "https://plugins.svn.wordpress.org/wp-event-solution/tags/4.1.27/",
  "https://wordpress.org/plugins/wp-event-solution/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-event-solution",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-16"
 }
}