CVE-2026-13039

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This is due to the plugin not properly verifying that a user is authorized to perform an action in the payment_complete() function of PaymentController.php. This makes it possible for unauthenticated attackers to mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash, granting themselves paid event access, QR-code attendee tickets, and order confirmation emails without making any real payment. The wp_rest nonce required to reach the vulnerable endpoint is embedded in every public event page, meaning no WordPress session or credentials are needed to obtain it. This vulnerability represents a regression — the same function and endpoint were previously patched but the fix did not persist through subsequent releases.

• CWE-862

• https://plugins.trac.wordpress.org/changeset?reponame=&old=3600977%40wp-event-solution&new=3600977%40wp-event-solution
• https://www.wordfence.com/threat-intel/vulnerabilities/id/84a5348a-a307-4db4-83b6-08682282a4b8?source=cve

Published

Jul 10, 2026

Last Modified

Jul 13, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-13033Out of bounds read and write in Blink>InterestGroups in Goog…8.8
• CVE-2026-13034Inappropriate implementation in Passwords in Google Chrome p…4.7
• CVE-2026-13035Use after free in Bluetooth in Google Chrome on Mac prior to…8.8
• CVE-2026-13036Use after free in Blink in Google Chrome prior to 149.0.7827…8.8
• CVE-2026-13037Use after free in WebView in Google Chrome on Android prior …7.8
• CVE-2026-13038Use after free in Autofill in Google Chrome on Windows prior…8.8
• CVE-2026-1304The Membership Plugin – Restrict Content for WordPress is vu…4.4
• CVE-2026-13040The NEX-Forms – Ultimate Forms Plugin for WordPress plugin f…7.2
• CVE-2026-13042The RPB Chessboard plugin for WordPress is vulnerable to Sto…7.2
• CVE-2026-1305The Japanized for WooCommerce plugin for WordPress is vulner…5.3
• CVE-2026-13050An Out-of-bounds Write vulnerability in WatchGuard Fireware …8.6
• CVE-2026-13053An Out-of-bounds Write vulnerability in WatchGuard Fireware …7.2