# Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.26 - Authenticated (Custom+) Missing Authorization to Order Status Manipulation and Attendee Reassignment

- **ID:** WPSEC-2026-1154
- **Plugin:** Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce (`wp-event-solution`), https://wordpress.org/plugins/wp-event-solution/
- **Affected versions:** all versions before 4.1.27
- **Fixed in:** 4.1.27 (Update to 4.1.27 or later.)
- **Severity:** Low 2.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-event-solution
- **Fix released:** 2026-10-16
- **Published:** 2026-10-17
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1154/

## Description

The Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data via the order and attendee REST API endpoints in all versions up to, and including, 4.1.26, due to missing event ownership checks. The etn_manage_order capability alone allowed setting an order's status whatever the event, and the order and attendee update endpoints accepted an event ID and attendee IDs from the request body without checking that they belong to the caller. This makes it possible for authenticated attackers who were granted Eventin's order or attendee management access (administrator-only by default, assignable to other roles) to create completed, unpaid orders on other organizers' events, rewrite attendees of other orders, and move orders or attendees onto events they do not own.

## References

- https://wpsec.com/vuln/WPSEC-2026-1154/
- https://plugins.svn.wordpress.org/wp-event-solution/tags/4.1.27/
- https://wordpress.org/plugins/wp-event-solution/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1154/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.