Eventin WordPress Plugin CVE-2026-12956

Exploitation requires the Eventin plugin (≤4.1.22) to be installed and active on a WordPress site with at least one event that has configured ticket inventory. No authentication is required: the wp_rest nonce needed to pass the permission check is embedded in every frontend page load via the etn-public JavaScript object, accessible to any site visitor including anonymous users. The forged-order persistence mechanism requires the event to use etn-order post types with ticket quantity limits configured - sites without ticket inventory tracking are unaffected by the inventory-exhaustion outcome. The CVSS AV:N/AC:L/PR:N/UI:N vector confirms no special network position, credentials, or user interaction are needed. Exploitation is limited to the ticket availability impact only; there is no path to data exfiltration or code execution from this vulnerability.

The provided CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately captures the network-accessible, zero-prerequisite attack vector but understates the availability dimension: indefinite ticket inventory exhaustion is a meaningful availability impact for event operators, not merely an integrity issue. The nonce leakage eliminates what would otherwise be a meaningful authorization gate, making this trivially automatable - even a mid-sized municipal IT team in legnica running a public ticketing site on Eventin should treat this as urgent for revenue-bearing events. EPSS data is not provided, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. No public proof-of-concept has been identified. The practical threat is targeted abuse of specific high-demand events (ticket scalping or denial of ticket sales) rather than opportunistic mass exploitation, since the attacker must target a site known to be running Eventin. The missing integrity check on status values combined with the permanent persistence of forged records amplifies real-world impact beyond a raw CVSS 5.3 would suggest for event-driven revenue contexts.

An attacker targeting a ticketed fundraiser or concert loads any public page of the WordPress site, extracts the wp_rest nonce from the etn-public script embedded in the page HTML, and then sends a loop of POST requests to /wp-json/eventin/v2/orders with the nonce and status=completed until the event's ticket quota is exhausted. Because the forged orders are never cleaned up, all tickets appear sold for the duration of the event, preventing legitimate purchases. No exploit code needs to be distributed - the technique is derivable directly from the plugin source code on WordPress's public Trac instance.