# Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.26 - Unauthenticated Payment Bypass via WooCommerce Order Linking

- **ID:** WPSEC-2026-1150
- **Plugin:** Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce (`wp-event-solution`), https://wordpress.org/plugins/wp-event-solution/
- **Affected versions:** all versions before 4.1.27
- **Fixed in:** 4.1.27 (Update to 4.1.27 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-840
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-event-solution
- **Fix released:** 2026-10-16
- **Published:** 2026-10-17
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1150/

## Description

The Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to a payment bypass via the WooCommerce checkout integration in all versions up to, and including, 4.1.26, due to the plugin trusting the 'event_order_id' session marker when it links a new WooCommerce order to an Eventin ticket order, without checking that the WooCommerce order contains that ticket or covers its price. The marker is not cleared when the whole cart is emptied. This makes it possible for unauthenticated attackers to link a free or low-cost WooCommerce order to a pending paid Eventin ticket order and have the booking marked completed without paying for it.

## References

- https://wpsec.com/vuln/WPSEC-2026-1150/
- https://plugins.svn.wordpress.org/wp-event-solution/tags/4.1.27/
- https://wordpress.org/plugins/wp-event-solution/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1150/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.