CVE-2026-12956: WP Event Solution Auth Bypass Vulnerability

CVE-2026-12956 Overview

CVE-2026-12956 is a Missing Authorization vulnerability [CWE-862] affecting the WP Event Solution (Eventin) plugin for WordPress in versions up to and including 4.1.22. The flaw resides in the create_item() handler for the /wp-json/eventin/v2/orders REST endpoint. The create_item_permissions_check() function only verifies a wp_rest nonce that the plugin leaks to every site visitor through the etn-public script's localized_data_obj. Unauthenticated attackers can create forged etn-order posts with status='completed' that count against ticket inventory and persist indefinitely.

Critical Impact

Unauthenticated attackers can exhaust event ticket inventory by submitting forged completed orders, disrupting ticket sales and event operations.

Affected Products

• WP Event Solution (Eventin) plugin for WordPress
• All versions up to and including 4.1.22
• WordPress sites exposing the etn-public script on frontend pages

Discovery Timeline

• 2026-09-09 - CVE-2026-12956 published to NVD
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-12956

Vulnerability Analysis

The Eventin plugin exposes a REST API route at /wp-json/eventin/v2/orders that accepts POST requests to create new order records. The endpoint's authorization guard, create_item_permissions_check(), evaluates only a wp_rest nonce rather than checking user capabilities. The plugin embeds this nonce in the localized_data_obj variable attached to the etn-public JavaScript, which loads on every frontend page. Any unauthenticated visitor can scrape the nonce and satisfy the permission check.

Once past the nonce gate, the request body flows into prepare_item_for_database(), which accepts a caller-supplied status field with no whitelist enforcement. Submitting status='completed' creates an order that etn_get_sold_tickets_by_event() counts toward inventory. The plugin's cleanup routine, wp_schedule_single_event(), only fires against orders with status='pending', so forged completed orders never expire.

Root Cause

The root cause is a combination of two design flaws. First, the endpoint conflates nonce verification with authorization, violating WordPress guidance that nonces protect against CSRF but not privilege enforcement. Second, prepare_item_for_database() trusts client-supplied status values without validating against an allowed list.

Attack Vector

An unauthenticated attacker retrieves the wp_rest nonce from any public page of the target site by parsing the etn-public localized data. The attacker then issues authenticated-looking POST requests to /wp-json/eventin/v2/orders with status='completed' and target event/ticket identifiers. Repeating the request in a loop drains available ticket inventory for the targeted event.

Refer to the Wordfence Vulnerability Report and the Eventin OrderController source for the affected code paths.

Detection Methods for CVE-2026-12956

Indicators of Compromise

• Unexpected etn-order posts in the WordPress database with status='completed' and no corresponding payment gateway transaction
• Anomalous volumes of POST requests to /wp-json/eventin/v2/orders from single IP addresses or IP ranges
• Events reporting sold-out status despite low or no legitimate purchase activity in payment logs
• REST API requests to the orders endpoint originating from clients that never rendered the checkout flow

Detection Strategies

• Compare etn-order post counts against payment gateway settlement records to identify orphaned completed orders
• Deploy web application firewall (WAF) rules that rate-limit or challenge unauthenticated POST requests to /wp-json/eventin/v2/orders
• Review WordPress access logs for repeated calls to the orders REST route without preceding session activity typical of legitimate buyers

Monitoring Recommendations

• Enable verbose logging on the WordPress REST API and forward logs to a centralized SIEM for correlation
• Alert on sudden ticket inventory depletion events that are not matched by revenue in the payment processor
• Track creation rates of etn-order custom post types and flag statistical anomalies

How to Mitigate CVE-2026-12956

Immediate Actions Required

• Update the WP Event Solution (Eventin) plugin to a version newer than 4.1.22 as soon as a fixed release is available
• Audit existing etn-order records and remove forged completed orders that do not correspond to legitimate transactions
• Restrict access to the /wp-json/eventin/v2/orders endpoint at the reverse proxy or WAF layer until patched

Patch Information

The vendor published a fix through the WordPress plugin repository. Review the Eventin plugin changeset for the corrective code changes. Site administrators should upgrade to the latest available release and verify the plugin version reflects the patched build.

Workarounds

• Deploy WAF rules to block unauthenticated POST requests to the /wp-json/eventin/v2/orders route
• Temporarily disable the Eventin plugin on sites that do not require active ticket sales until the patch is applied
• Restrict WordPress REST API access to authenticated users via a plugin or custom rest_authentication_errors filter where feasible

# Example nginx rule to block unauthenticated POSTs to the vulnerable endpoint
location ~ ^/wp-json/eventin/v2/orders {
    if ($request_method = POST) {
        return 403;
    }
}