WordPress Plugin Vulnerabilities

Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation

Description

The plugin does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment.

Proof of Concept

Affects Plugins

Plugin icon
wp-event-solution
Fixed in 4.1.16

References

CVE
CVE-2026-13178

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639

Miscellaneous

Original Researcher
Haitam Lazaar
Submitter
Haitam Lazaar
Submitter website
https://www.linkedin.com/in/haitam-lazaar/
Verified
Yes
WPVDB ID
09d6135f-b38c-4cfe-8a9f-5d79552c720c

Timeline

Publicly Published
2026-07-13 (about 13 days ago)
Added
2026-07-13 (about 12 days ago)
Last Updated
2026-07-13 (about 12 days ago)

Other

Published
Title
Published
2025-02-23
Title
Recipe Card Blocks for Gutenberg & Elementor < 3.4.4 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Disclosure
Published
2026-06-26
Title
PPWP – Password Protect Pages < 1.9.20 - Authenticated (Contributor+) Insecure Direct Object Reference
Published
2025-08-14
Title
Order Tip for WooCommerce < 1.5.5 - Unauthenticated Tip Manipulation to Negative Value Leading to Unauthorized Discounts
Published
2025-11-10
Title
The Total Book Project < 1.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Book Manipulation
Published
2022-08-04
Title
Sensei LMS < 4.5.2 - Arbitrary Private Message Sending via IDOR