CVE-2026-13039

Name of the Vulnerable Software and Affected Versions Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) versions 4.0.26 through 4.1.15

Description An authorization bypass exists because the payment complete() function in PaymentController.php fails to properly verify if a user is authorized to perform an action. Unauthenticated attackers can mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash. This allows unauthorized users to obtain paid event access, QR-code attendee tickets, and order confirmation emails without payment. The required wp rest nonce is available on every public event page, removing the need for WordPress sessions or credentials. This issue is a regression, as the function and endpoint were previously patched but the fix was lost in later releases.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.