FKIE_CVE-2026-12956

Vulnerability from fkie_nvd - Published: 2026-09-09 03:17 - Updated: 2026-09-09 15:33
Severity
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Summary
The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the create_item() handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's create_item_permissions_check() function only verifies a wp_rest nonce (which is leaked to every visitor through the etn-public script's localized_data_obj on every frontend page) and accepts a user-supplied 'status' value in prepare_item_for_database() with no whitelist validation. This makes it possible for unauthenticated attackers to create etn-order posts with status='completed' that are counted as sold by etn_get_sold_tickets_by_event(); because the auto-cleanup wp_schedule_single_event() in create_item() only fires for status='pending' orders, the forged completed orders persist indefinitely and exhaust ticket inventory.
References
security@wordfence.comhttps://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/Order/OrderController.php#L1325
security@wordfence.comhttps://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/Order/OrderController.php#L413
security@wordfence.comhttps://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/Order/OrderController.php#L733
security@wordfence.comhttps://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/utils/helper.php#L4558
security@wordfence.comhttps://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/utils/locale/vars.php#L35
security@wordfence.comhttps://plugins.trac.wordpress.org/changeset?reponame=&old=3668637%40wp-event-solution&new=3668637%40wp-event-solution
security@wordfence.comhttps://www.wordfence.com/threat-intel/vulnerabilities/id/5e87a9ac-e7c6-4622-b3e5-6e17e7664317?source=cve
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Eventin \u2013 Event Calendar, Tickets, Registration, Booking \u0026 WooCommerce",
          "vendor": "arraytics",
          "versions": [
            {
              "lessThanOrEqual": "4.1.22",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@wordfence.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the create_item() handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint\u0027s create_item_permissions_check() function only verifies a wp_rest nonce (which is leaked to every visitor through the etn-public script\u0027s localized_data_obj on every frontend page) and accepts a user-supplied \u0027status\u0027 value in prepare_item_for_database() with no whitelist validation. This makes it possible for unauthenticated attackers to create etn-order posts with status=\u0027completed\u0027 that are counted as sold by etn_get_sold_tickets_by_event(); because the auto-cleanup wp_schedule_single_event() in create_item() only fires for status=\u0027pending\u0027 orders, the forged completed orders persist indefinitely and exhaust ticket inventory."
    }
  ],
  "id": "CVE-2026-12956",
  "lastModified": "2026-09-09T15:33:47.627",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security@wordfence.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-12956",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-09T13:54:47.100590Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-09T03:17:22.470",
  "references": [
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/Order/OrderController.php#L1325"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/Order/OrderController.php#L413"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/Order/OrderController.php#L733"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/utils/helper.php#L4558"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/utils/locale/vars.php#L35"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3668637%40wp-event-solution\u0026new=3668637%40wp-event-solution"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5e87a9ac-e7c6-4622-b3e5-6e17e7664317?source=cve"
    }
  ],
  "sourceIdentifier": "security@wordfence.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security@wordfence.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.