CVE-2026-15398: Eventin WordPress Plugin Auth Bypass Flaw

CVE-2026-15398 Overview

CVE-2026-15398 is an authorization bypass vulnerability in the Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress. The flaw affects all versions up to and including 4.1.22. The plugin fails to properly verify that a user is authorized to perform sensitive booking actions. Authenticated attackers with subscriber-level access can bypass payment for paid events, mark orders as completed, deplete ticket inventory, and trigger confirmation emails for tickets that were never purchased. Unauthenticated attackers can also exploit the flaw because the wp_rest nonce is publicly emitted on every frontend page, and the order creation endpoint returns an order_access_token to any caller possessing that nonce.

Critical Impact
Unauthenticated attackers can bypass payment on paid events, mark fraudulent orders complete, and exhaust ticket inventory by chaining a public nonce with a leaked order_access_token.

Affected Products

Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress
All versions up to and including 4.1.22
Underlying package: wp-event-solution

Discovery Timeline

2026-09-09 - CVE-2026-15398 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-15398

Vulnerability Analysis

The vulnerability is a Missing Authorization flaw [CWE-862] in the plugin's order handling logic. The Eventin plugin exposes REST endpoints in its OrderController class that gate privileged actions on the presence of a valid wp_rest nonce and an order_access_token. Neither value is treated as a true authorization signal. The wp_rest nonce is enqueued and rendered on every frontend page for any visitor. The order creation endpoint mints and returns a fresh order_access_token to any caller that presents the nonce, including anonymous visitors.

Once an attacker holds both values, they can call the update_booking_status branch to mark an order as completed without payment. The same code path also decrements available ticket inventory and dispatches confirmation emails. This allows abuse well beyond a single fraudulent ticket purchase, extending to denial of ticket availability and social engineering through spoofed confirmations.

Root Cause

The root cause is reliance on request artifacts that are not scoped to an authenticated user. The permission_callback for the affected REST routes does not verify capability, ownership, or payment state. Instead, it checks for values that the plugin itself distributes to unauthenticated visitors. This collapses the distinction between authentication material and authorization material.

Attack Vector

Exploitation is network-based over standard HTTP(S). An attacker scrapes the wp_rest nonce from any public page served by the WordPress site running the vulnerable plugin. The attacker then issues a request to the order creation endpoint to obtain an order_access_token. Finally, the attacker calls the booking status update endpoint with both values to complete a fraudulent order, drain remaining tickets, or trigger email delivery. See the Wordfence Vulnerability Report and the WordPress OrderController Class Line 440 reference for the affected code paths.

Detection Methods for CVE-2026-15398

Indicators of Compromise

Unexpected POST requests to Eventin REST routes such as /wp-json/eventin/v2/orders and booking status update endpoints from IPs not associated with authenticated customers.
Orders in the completed state with no matching payment gateway transaction ID or with a zero-value payment record.
Sudden depletion of ticket inventory for a scheduled event with no corresponding revenue.
Outbound ticket confirmation emails to recipients that do not appear in the site's user or customer database.

Detection Strategies

Correlate WordPress REST API access logs with Eventin order records to flag orders whose status transitions to completed without a preceding gateway callback.
Baseline the ratio of order_access_token mint events to authenticated customer sessions, and alert on unauthenticated spikes.
Inspect web server logs for scraping patterns that harvest the wp_rest nonce followed immediately by calls to /orders and status update endpoints.

Monitoring Recommendations

Forward WordPress access, application, and mail logs to a centralized analytics platform for correlation across order creation, status updates, and email dispatch.
Alert on abnormal ticket inventory decrements outside normal buying hours or from a narrow set of source IPs.
Track anomalous volumes of confirmation emails per event and per hour.

How to Mitigate CVE-2026-15398

Immediate Actions Required

Update the Eventin plugin to a version later than 4.1.22 that includes the fix referenced in the WordPress Event Solution Changeset Update.
Audit all orders created while a vulnerable version was installed, focusing on completed orders without matching payment gateway records.
Reconcile ticket inventory against verified paid orders and reissue capacity where fraudulent completions occurred.

Patch Information

The vendor addressed the flaw in the wp-event-solution package following version 4.1.22. Review the fixed order handling logic in the WordPress OrderController Class v4.1.16 Line 440 reference and confirm your installed version reflects the corrected permission_callback handling. Site administrators should apply the plugin update through the WordPress admin dashboard or via WP-CLI.

Workarounds

Deactivate the Eventin plugin until the patched version can be installed if paid ticketing is not actively in use.
Restrict access to /wp-json/eventin/* REST routes at the web application firewall level to authenticated sessions or trusted IP ranges.
Temporarily disable public event registration pages so the wp_rest nonce is not emitted alongside vulnerable order endpoints.

bash

# Example: update the plugin via WP-CLI once the patched release is available
wp plugin update wp-event-solution
wp plugin get wp-event-solution --field=version