EUVD-2026-74760
GHSA-469h-qjmg-2g33
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
PR:N because the publicly emitted nonce and unconditional order_access_token issuance make exploitation fully unauthenticated; I:H for fraudulent order completion and financial bypass; A:L for ticket inventory depletion.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Eventin - Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.22. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to bypass payment for paid events, fraudulently mark orders as completed, deplete ticket inventory, and trigger confirmation emails for tickets never purchased. This is exploitable by unauthenticated attackers because the wp_rest nonce is publicly emitted on every frontend page, and the order creation endpoint mints and returns an order_access_token to any caller possessing that nonce - giving unauthenticated users all credentials required to reach the privileged update_booking_status branch.
AnalysisAI
Authorization bypass in the Eventin event management plugin for WordPress (all versions ≤ 4.1.22) enables attackers to fraudulently claim paid tickets, mark unprocessed orders as completed, deplete ticket inventory, and trigger confirmation emails - all without making payment. While the formal CVSS vector assigns PR:L (subscriber-level access), the CVE description explicitly confirms a fully unauthenticated exploitation path: the wp_rest nonce is emitted on every frontend page, and the order creation endpoint issues an order_access_token to any caller possessing that nonce, granting anonymous users the credential material to invoke the privileged update_booking_status branch. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The nonce-to-token chain is the critical enabling condition: the wp_rest nonce is emitted on every frontend WordPress page by the plugin's Enqueue/frontend.php (line 28) and utils/locale/vars.php (line 35), making it freely available to any anonymous visitor without any login. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 4.3 with I:L substantially understates real-world business impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Eventin plugin immediately to the version succeeding 4.1.22; a patch changeset has been committed to the WordPress plugin repository (https://plugins.trac.wordpress.org/changeset?reponame=&old=3668637%40wp-event-solution&new=3668637%40wp-event-solution), though the exact release version number carrying this fix is not independently confirmed from available data - verify the latest available version on the WordPress.org plugin page. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Woocommerce
View allThe WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severit
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooComm
The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when processing its tab actions, which
The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when canceling pre-orders, which could
The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when up
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today