CVE-2026-12956: Eventin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter
The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the createitem() handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's createitempermissionscheck() function only verifies a wprest nonce (which is leaked to every visitor through the etn-public script's localizeddataobj on every frontend page) and accepts a user-supplied 'status' value in prepareitemfordatabase() with no whitelist validation. This makes it possible for unauthenticated attackers to create etn-order posts with status='completed' that are counted as sold by etngetsoldticketsbyevent(); because the auto-cleanup wpschedulesingleevent() in createitem() only fires for status='pending' orders, the forged completed orders persist indefinitely and exhaust ticket inventory.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites running the Eventin WordPress plugin in version 4.1.22 or earlier are affected. The nonce required by the vulnerable REST endpoint is exposed to every visitor through frontend-page script data, so an attacker does not need an authenticated WordPress account.
What can an attacker do with the exposed nonce?
An attacker can submit requests to the /wp-json/eventin/v2/orders endpoint to create Eventin order posts and supply a status of completed. These forged completed orders are counted as sold tickets, allowing inventory for an event to be exhausted.
Are forged orders automatically removed?
No, not when the attacker sets the order status to completed. The documented cleanup scheduling applies only to pending orders, so completed forged orders can persist indefinitely.
How can I check whether exploitation may have occurred?
Review Eventin order posts for unexpected orders marked completed and compare them with legitimate purchase records. Orders contributing to sold-ticket counts without corresponding valid transactions are indicators of potential abuse.