What is the CVSS score of CVE-2026-13039?

CVE-2026-13039 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Eventin WordPress Plugin CVE-2026-13039

EUVD-2026-43025 MEDIUM

Missing Authorization (CWE-862)

2026-07-10 Wordfence

GHSA-xcc9-4v86-gf8f

Authentication Bypass WordPress PHP Eventin Event Calendar Event Registration Tickets Booking Ai Powered

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network REST endpoint reachable with publicly embedded nonce (PR:N, AC:L); impact limited to integrity via fraudulent order completion, no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 22:01 vuln.today

CVE Published

Jul 10, 2026 - 20:31 nvd

MEDIUM 5.3

DescriptionCVE.org

The Eventin - Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This is due to the plugin not properly verifying that a user is authorized to perform an action in the payment_complete() function of PaymentController.php. This makes it possible for unauthenticated attackers to mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash, granting themselves paid event access, QR-code attendee tickets, and order confirmation emails without making any real payment. The wp_rest nonce required to reach the vulnerable endpoint is embedded in every public event page, meaning no WordPress session or credentials are needed to obtain it. This vulnerability represents a regression - the same function and endpoint were previously patched but the fix did not persist through subsequent releases.

AnalysisAI

Authorization bypass in the Eventin WordPress plugin (versions 4.0.26-4.1.15) enables unauthenticated attackers to mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash to the payment_complete() REST endpoint. The wp_rest nonce required to reach this endpoint is embedded in the HTML of every public event page, eliminating any credential or session requirement. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Visit public event page

Delivery

Extract wp_rest nonce from page HTML

Exploit

Create or identify unpaid ticket order

Execution

Submit fabricated SureCart/FluentCart token to payment_complete()

Persist

Server marks order as paid

Impact

Receive valid QR ticket and confirmation email

Access

Visit public event page

Delivery

Extract wp_rest nonce from page HTML

Exploit

Create or identify unpaid ticket order

Execution

Submit fabricated SureCart/FluentCart token to payment_complete()

Persist

Server marks order as paid

Impact

Receive valid QR ticket and confirmation email

Vulnerability AssessmentAI

Exploitation	Exploitation requires the target WordPress site to be running Eventin versions 4.0.26 through 4.1.15 with at least one publicly accessible event page (from which the wp_rest nonce can be extracted by an unauthenticated visitor). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD CVSS 5.3 Medium score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately captures the technical profile but underrepresents the business impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker visits any public event page on a WordPress site running Eventin 4.0.26-4.1.15, extracts the wp_rest nonce from the page HTML, and submits a crafted POST request to the payment_complete() REST endpoint referencing an existing unpaid order with a fabricated SureCart checkout ID or FluentCart cart hash. The server, lacking the authorization check, processes the request as legitimate, marks the order complete, and issues the attacker QR-code attendee tickets and a confirmation email - granting paid event access at zero cost. …
Remediation	Update the Eventin plugin to a version beyond 4.1.15 where the authorization check in payment_complete() has been restored. … Detailed patch versions, workarounds, and compensating controls in full report.