CVE-2026-13177: Eventin WordPress Plugin Info Disclosure

CVE-2026-13177 Overview

CVE-2026-13177 is an Insecure Direct Object Reference (IDOR) vulnerability in the Eventin WordPress plugin before version 4.1.20. The plugin fails to properly restrict access to individual order records. Authenticated users with contributor-level access or above can read other customers' order data by iterating order identifiers. The exposed data includes personally identifiable information (PII) tied to event ticket purchases. Site owners running Eventin for paid events or ticketing are affected.

Critical Impact
Any authenticated contributor can enumerate order IDs and harvest customer PII from the Eventin ordering system, creating a privacy and compliance exposure for affected WordPress sites.

Affected Products

Eventin WordPress plugin versions prior to 4.1.20
WordPress sites using Eventin for event ticketing and order management
WordPress installations that permit contributor-level or higher accounts

Discovery Timeline

2026-08-12 - CVE-2026-13177 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-13177

Vulnerability Analysis

The vulnerability is a Broken Access Control flaw, specifically an Insecure Direct Object Reference on order record endpoints. Eventin exposes order lookups keyed by a numeric or otherwise predictable identifier. The plugin authenticates the requester but does not verify that the requester owns the order or has a business-role reason to view it.

A user with the WordPress contributor role, which is normally the lowest publishing role, can request arbitrary order IDs sequentially. Each successful request returns another customer's order record. The returned data includes personal information collected at checkout such as name, email address, and order details.

Because exploitation only requires an authenticated low-privilege account, sites that permit user registration or that host multiple content contributors are directly exposed. The flaw is a pure authorization defect, not an authentication bypass, and requires no special tooling beyond an HTTP client.

Root Cause

The plugin's order retrieval logic checks that the caller is logged in but omits an ownership or capability check against each requested order. The route trusts the supplied order identifier and returns the corresponding record without validating that the current user is the order's customer or an administrator.

Attack Vector

An attacker registers or compromises a contributor-level account on the target WordPress site. The attacker then issues sequential requests to the Eventin order endpoint, incrementing the order identifier on each request. The plugin returns each order's contents, allowing bulk harvesting of customer PII. See the WPScan Vulnerability Report for technical detail on the vulnerable endpoint.

Detection Methods for CVE-2026-13177

Indicators of Compromise

Repeated sequential requests from a single authenticated session to Eventin order endpoints with incrementing order ID parameters
Contributor or subscriber accounts issuing high volumes of requests to order-related REST or AJAX routes
Unexpected outbound traffic from web servers following bulk order enumeration patterns in access logs

Detection Strategies

Review WordPress access logs for admin-ajax.php or REST API calls targeting Eventin order routes from non-administrator users
Alert on any single session enumerating monotonically increasing numeric identifiers against plugin endpoints
Compare requesting user role against the owner of the requested order and flag mismatches

Monitoring Recommendations

Enable verbose logging on the Eventin plugin and forward WordPress logs to a centralized SIEM for correlation
Baseline normal contributor activity and alert on deviations such as sustained API access outside content authoring workflows
Monitor new low-privilege account registrations that immediately access ticketing or order endpoints

How to Mitigate CVE-2026-13177

Immediate Actions Required

Update the Eventin plugin to version 4.1.20 or later on all WordPress sites
Audit existing contributor, author, and higher-role accounts and remove or disable any that are not required
Review order access logs for the past several months to identify possible prior enumeration

Patch Information

The vendor addressed CVE-2026-13177 in Eventin 4.1.20. The fix enforces an ownership and capability check on order retrieval so that non-administrative users cannot read orders belonging to other customers. Site owners should apply the update through the WordPress plugin manager or by deploying the patched release from the vendor. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable the Eventin plugin until the site can be updated to 4.1.20 or later
Restrict user registration and require administrator approval for new accounts on affected sites
Place the WordPress admin and AJAX endpoints behind a web application firewall rule that rate-limits authenticated access to order routes

bash

# Update Eventin via WP-CLI to the fixed version
wp plugin update wp-event-solution --version=4.1.20

# Verify installed version
wp plugin get wp-event-solution --field=version

# Optional: disable the plugin until patched
wp plugin deactivate wp-event-solution