CVE-2026-13039 Details
Description
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This is due to the plugin not properly verifying that a user is authorized to perform an action in the payment_complete() function of PaymentController.php. This makes it possible for unauthenticated attackers to mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash, granting themselves paid event access, QR-code attendee tickets, and order confirmation emails without making any real payment. The wp_rest nonce required to reach the vulnerable endpoint is embedded in every public event page, meaning no WordPress session or credentials are needed to obtain it. This vulnerability represents a regression — the same function and endpoint were previously patched but the fix did not persist through subsequent releases.
A vulnerability exists in the Eventin WordPress plugin, specifically in the Event Calendar, Event Registration, Tickets & Booking (AI Powered) category, versions 4.0.26 to 4.1.15. The issue arises from an authorization bypass in the payment_complete() function of PaymentController.php, where the plugin fails to properly verify user authorization for certain actions. This flaw enables unauthenticated attackers to falsely mark unpaid ticket orders as completed by submitting a fake SureCart checkout ID or FluentCart cart hash. As a result, attackers can gain access to paid events, receive QR-code tickets, and obtain order confirmation emails without making any actual payment. The vulnerability is exacerbated by the fact that the wp_rest nonce needed to access the vulnerable endpoint is available on every public event page, eliminating the need for a WordPress session or credentials. This issue is a regression, as the function and endpoint had been patched in the past, but the fix was not maintained in later versions.
Users are advised to update the Eventin WordPress plugin to version 4.1.16 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 10, 2026CISA-ADP
Assessed Jul 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Eventin | >= 4.0.26, <= 4.1.15 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 13, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |