Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.26 - Authenticated (Custom+) Missing Authorization to Order Status Manipulation and Attendee Reassignment
- ID
- WPSEC-2026-1154
- Plugin
- Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce (wp-event-solution)
- Affected
- all versions before 4.1.27
- Remediation
- Update to 4.1.27 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-16
- Attack surface
- Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data via the order and attendee REST API endpoints in all versions up to, and including, 4.1.26, due to missing event ownership checks. The etn_manage_order capability alone allowed setting an order's status whatever the event, and the order and attendee update endpoints accepted an event ID and attendee IDs from the request body without checking that they belong to the caller. This makes it possible for authenticated attackers who were granted Eventin's order or attendee management access (administrator-only by default, assignable to other roles) to create completed, unpaid orders on other organizers' events, rewrite attendees of other orders, and move orders or attendees onto events they do not own.
References
- https://wpsec.com/vuln/WPSEC-2026-1154/
- https://plugins.svn.wordpress.org/wp-event-solution/tags/4.1.27/
- https://wordpress.org/plugins/wp-event-solution/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS