CVE-2026-13039: Eventin WordPress Auth Bypass Vulnerability

CVE-2026-13039 Overview

CVE-2026-13039 is an authorization bypass vulnerability in the Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress. The flaw affects versions from 4.0.26 up to and including 4.1.15. The payment_complete() function in PaymentController.php fails to verify that a user is authorized to complete a payment action. Unauthenticated attackers can mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash. This grants free access to paid events, QR-code attendee tickets, and order confirmation emails. The vulnerability is a regression of a previously patched issue.

Critical Impact
Unauthenticated attackers can obtain paid event tickets and confirmation emails without payment by bypassing authorization checks on the payment completion endpoint.

Affected Products

Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin version 4.0.26
Eventin plugin versions 4.0.27 through 4.1.14
Eventin plugin version 4.1.15

Discovery Timeline

2026-07-10 - CVE-2026-13039 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-13039

Vulnerability Analysis

The vulnerability resides in the payment_complete() function of PaymentController.php within the Eventin plugin. The function processes payment completion callbacks but omits a proper authorization check. Attackers can submit a crafted SureCart checkout ID or FluentCart cart hash to mark unpaid orders as complete. Once marked complete, the plugin issues QR-code attendee tickets and confirmation emails to the attacker.

The endpoint requires a wp_rest nonce, but the plugin embeds this nonce in every public event page. Any unauthenticated visitor can extract the nonce without a WordPress session or credentials. This eliminates the only remaining control on the endpoint.

The issue is a regression [CWE-862 Missing Authorization]. The same function received a fix in a prior release, but the correction did not persist through subsequent versions.

Root Cause

The root cause is missing authorization in the REST payment callback handler. The function trusts client-supplied checkout identifiers as proof of successful payment. It does not validate these identifiers against the payment provider or verify the caller's authority to complete the order.

Attack Vector

An attacker retrieves the wp_rest nonce from any public event page on the target WordPress site. The attacker then sends a POST request to the plugin's payment completion REST endpoint. The request body contains a fabricated SureCart checkout ID or FluentCart cart hash and a target order identifier. The plugin marks the order as paid and delivers ticket assets to the address associated with the order.

Refer to the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-13039

Indicators of Compromise

Ticket orders transitioning to a completed state without a matching transaction record at SureCart or FluentCart
Unexpected QR-code ticket emails or order confirmation emails sent to addresses not associated with prior customer accounts
REST requests to the Eventin payment completion endpoint originating from IP addresses that never loaded the checkout page

Detection Strategies

Correlate WordPress access logs for POST requests to Eventin REST payment endpoints against payment gateway transaction logs to identify orders completed without a corresponding real charge
Alert on repeated requests to the payment completion endpoint from a single IP with varying order IDs, which suggests enumeration
Review Eventin order tables for orders marked paid where the associated SureCart checkout ID or FluentCart cart hash does not exist in the payment provider records

Monitoring Recommendations

Enable request logging for /wp-json/ routes related to the Eventin plugin and retain logs for reconciliation with payment provider data
Monitor outbound email volume for spikes in ticket confirmation and QR-code delivery messages
Track version drift on WordPress plugins to identify sites still running Eventin 4.0.26 through 4.1.15

How to Mitigate CVE-2026-13039

Immediate Actions Required

Update the Eventin plugin to a version later than 4.1.15 that contains the reinstated authorization check
Reconcile recent event orders against SureCart and FluentCart transaction records and cancel any orders lacking a real payment
Revoke QR-code tickets issued during the exposure window and reissue only to verified paying attendees

Patch Information

The plugin vendor addressed the regression in a subsequent release. Review the WordPress Changeset Update for the code-level fix. Site operators should apply the update through the WordPress plugin management interface.

Workarounds

Disable the Eventin plugin until the patched version is installed if immediate updates are not feasible
Restrict access to the plugin's REST payment completion endpoint at the web server or web application firewall layer
Temporarily disable public event pages to prevent unauthenticated extraction of the wp_rest nonce

bash

# Example nginx rule to block the vulnerable REST endpoint
location ~ ^/wp-json/eventin/.*/payment_complete {
    deny all;
    return 403;
}