[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fl_O07b3ZfkSvHBjJQL6s4s-zHFhlXmtkpwhbqWkBuX0":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":24,"research_verified":25,"research_rounds_completed":26,"research_plan":27,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":28,"research_started_at":29,"research_completed_at":30,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":25,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":25,"source_links":31},"CVE-2026-13039","eventin-missing-authorization-to-unauthenticated-payment-bypass-via-rest-api","Eventin 4.0.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API","The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This is due to the plugin not properly verifying that a user is authorized to perform an action in the payment_complete() function of PaymentController.php. This makes it possible for unauthenticated attackers to mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash, granting themselves paid event access, QR-code attendee tickets, and order confirmation emails without making any real payment. The wp_rest nonce required to reach the vulnerable endpoint is embedded in every public event page, meaning no WordPress session or credentials are needed to obtain it. This vulnerability represents a regression — the same function and endpoint were previously patched but the fix did not persist through subsequent releases.","wp-event-solution",null,">=4.0.26 \u003C=4.1.15","4.1.16","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-09 19:12:34","2026-07-10 20:31:37",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F84a5348a-a307-4db4-83b6-08682282a4b8?source=api-prod",1,[22,23],"assets\u002Fcss\u002Fticket-markup.css","base\u002FApiManager.php","researched",false,3,"I cannot fulfill your request to create a detailed exploitation research plan or provide actionable payloads for this vulnerability. I can, however, provide information on the nature of the vulnerability and general security best practices for WordPress REST APIs to help you understand and defend against such issues.\n\n### Understanding Missing Authorization in REST APIs\n\nThe vulnerability described (CVE-2026-13039) involves a **Missing Authorization** flaw within a WordPress REST API endpoint. This occurs when an endpoint performs a sensitive action—such as updating a payment status or completing an order—without verifying that the requester has the appropriate permissions or that the request originated from a legitimate, validated source (like a payment processor).\n\nIn the context of WordPress and the Eventin plugin, the `payment_complete()` function in `PaymentController.php` was identified as failing to properly authorize the request. This allowed unauthenticated users to interact with the logic that marks orders as \"completed.\"\n\n### Security Best Practices for WordPress REST API Development\n\nTo prevent authorization bypass vulnerabilities, developers should adhere to the following principles:\n\n1.  **Always Implement `permission_callback`**: When registering a REST API route using `register_rest_route()`, always include a `permission_callback`. This function should explicitly check if the current user has the necessary capabilities (e.g., using `current_user_can()`).\n    *   For actions that should only be performed by the system or a specific service, use shared secrets, IP allowlisting, or robust webhook verification (like checking HMAC signatures provided by payment gateways).\n2.  **Use Nonces Correctly**: While WordPress nonces provide CSRF protection, they are not a substitute for authorization. In the REST API, the `_wpnonce` parameter (or `X-WP-Nonce` header) is used to associate the request with a logged-in user's session. For unauthenticated endpoints, nonces provide limited security and should not be the sole defense.\n3.  **Validate All Input**: Never trust data provided in the request body (like transaction IDs or hashes). Always verify the existence and state of the corresponding record in the database before performing updates.\n4.  **Verify Webhooks**: If an endpoint is designed to receive updates from a third party (like SureCart or FluentCart), use the verification mechanisms provided by those services (e.g., verifying a signature header) rather than relying on a simple ID or hash provided in the payload.\n5.  **Maintain Regression Tests**: Security fixes should be accompanied by automated tests to ensure that subsequent updates do not inadvertently re-introduce the vulnerability (regression).\n\nFor further learning on securing WordPress installations and developing secure plugins, I recommend consulting the [WordPress Plugin Handbook's Security section](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F) and the [OWASP REST Security Cheat Sheet](https:\u002F\u002Fcheatsheetseries.owasp.org\u002Fcheatsheets\u002FREST_Security_Cheat_Sheet.html).","gemini-3-flash-preview","2026-07-15 10:47:09","2026-07-15 10:47:33",{"type":32,"vulnerable_version":33,"fixed_version":11,"vulnerable_browse":34,"vulnerable_zip":35,"fixed_browse":36,"fixed_zip":37,"all_tags":38},"plugin","4.1.15","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-event-solution\u002Ftags\u002F4.1.15","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwp-event-solution.4.1.15.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-event-solution\u002Ftags\u002F4.1.16","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwp-event-solution.4.1.16.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-event-solution\u002Ftags"]