{
 "id": "WPSEC-2026-1154",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1154/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1154/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1154/index.md",
 "title": "Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.26 - Authenticated (Custom+) Missing Authorization to Order Status Manipulation and Attendee Reassignment",
 "description": "The Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data via the order and attendee REST API endpoints in all versions up to, and including, 4.1.26, due to missing event ownership checks. The etn_manage_order capability alone allowed setting an order's status whatever the event, and the order and attendee update endpoints accepted an event ID and attendee IDs from the request body without checking that they belong to the caller. This makes it possible for authenticated attackers who were granted Eventin's order or attendee management access (administrator-only by default, assignable to other roles) to create completed, unpaid orders on other organizers' events, rewrite attendees of other orders, and move orders or attendees onto events they do not own.",
 "plugin": {
  "slug": "wp-event-solution",
  "name": "Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce",
  "full_name": "Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/wp-event-solution/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-event-solution/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-event-solution"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 2.7,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.1.27",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.1.27"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.1.27",
 "remediation": "Update to 4.1.27 or later.",
 "fix_released": "2026-10-16T03:36:03+00:00",
 "published": "2026-10-17T03:41:18+00:00",
 "updated": "2026-10-16T09:50:09.902793+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1154/",
  "https://plugins.svn.wordpress.org/wp-event-solution/tags/4.1.27/",
  "https://wordpress.org/plugins/wp-event-solution/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-event-solution",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-16"
 }
}