What is the CVSS score of EUVD-2026-43025?

EUVD-2026-43025 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Eventin WordPress Plugin EUVD-2026-43025

| CVE-2026-13039 MEDIUM

Missing Authorization (CWE-862)

2026-07-10 Wordfence

GHSA-xcc9-4v86-gf8f

PHP WordPress Authentication Bypass Eventin Event Calendar Event Registration Tickets Booking Ai Powered Wordpress Plugin Arraytics

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network REST endpoint reachable with publicly embedded nonce (PR:N, AC:L); impact limited to integrity via fraudulent order completion, no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 22:01 vuln.today

CVE Published

Jul 10, 2026 - 20:31 nvd

MEDIUM 5.3

DescriptionCVE.org

The Eventin - Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This is due to the plugin not properly verifying that a user is authorized to perform an action in the payment_complete() function of PaymentController.php. This makes it possible for unauthenticated attackers to mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash, granting themselves paid event access, QR-code attendee tickets, and order confirmation emails without making any real payment. The wp_rest nonce required to reach the vulnerable endpoint is embedded in every public event page, meaning no WordPress session or credentials are needed to obtain it. This vulnerability represents a regression - the same function and endpoint were previously patched but the fix did not persist through subsequent releases.

AnalysisAI

Authorization bypass in the Eventin WordPress plugin (versions 4.0.26-4.1.15) enables unauthenticated attackers to mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash to the payment_complete() REST endpoint. The wp_rest nonce required to reach this endpoint is embedded in the HTML of every public event page, eliminating any credential or session requirement. This is a confirmed regression - the same function and endpoint were previously patched by Arraytics, but the fix was lost in subsequent releases; no public exploit has been identified at time of analysis.

Technical ContextAI

The root cause is CWE-862 (Missing Authorization) in the payment_complete() function of PaymentController.php within the Eventin plugin (CPE: cpe:2.3:a:arraytics:eventin_-_event_calendar,_event_registration,_tickets_&_booking_(ai_powered):*:*:*:*:*:*:*:*). The plugin exposes a WordPress REST API endpoint that accepts payment completion callbacks from the SureCart and FluentCart payment processors, using a checkout ID or cart hash as the confirmation token. The authorization check that should verify the caller's right to complete a given order was regressed out of the codebase between versions 4.0.26 and 4.1.15. WordPress REST API endpoints are typically protected by a wp_rest nonce as a CSRF control, but because this nonce is embedded in the JavaScript configuration of every public event page (via wp_localize_script or equivalent), it is trivially retrievable by any unauthenticated visitor - it does not function as an authentication gate in this context.

RemediationAI

Update the Eventin plugin to a version beyond 4.1.15 where the authorization check in payment_complete() has been restored. The upstream code fix is available via the WordPress plugin Trac changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3600977%40wp-event-solution&new=3600977%40wp-event-solution; however, the exact released patch version number is not independently confirmed from available data - verify against the WordPress plugin repository directly. If an immediate update is not possible, a specific compensating control is to block unauthenticated POST requests to the REST API route handled by PaymentController.php at the WAF or nginx/Apache level - note this will break legitimate SureCart and FluentCart payment callbacks until the route can be re-restricted to authenticated or signed requests. Site administrators should also audit existing order records for anomalous completions (orders marked complete with no corresponding payment gateway transaction ID) to identify prior exploitation. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/84a5348a-a307-4db4-83b6-08682282a4b8 provides additional remediation context.