CVE-2026-15398: Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.22. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to bypass payment for paid events, fraudulently mark orders as completed, deplete ticket inventory, and trigger confirmation emails for tickets never purchased. This is exploitable by unauthenticated attackers because the wprest nonce is publicly emitted on every frontend page, and the order creation endpoint mints and returns an orderaccesstoken to any caller possessing that nonce — giving unauthenticated users all credentials required to reach the privileged updatebookingstatus branch.
Affected Software
Event History
Frequently Asked Questions
Are sites that allow anonymous visitors to create event orders exposed, or is a WordPress account required?
Anonymous visitors can exploit the issue. A wp_rest nonce is publicly emitted on frontend pages, and the order-creation endpoint returns an order_access_token to callers with that nonce, providing the credentials needed to access the privileged booking-status update path.
What could an attacker do after exploiting this issue?
An attacker can bypass payment for paid events, mark orders as completed fraudulently, redeem free tickets, deplete ticket inventory, and trigger confirmation emails for tickets that were not purchased.
Which plugin versions are affected?
All versions through 4.1.22, including 4.1.22, are affected.