Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
120 vulnerabilities by Arraytics
CVE-2026-62135 (GCVE-0-2026-62135)
Vulnerability from nvd – Published: 2026-09-11 18:12 – Updated: 2026-09-11 20:19
VLAI
EPSS
VEX
Title
WordPress Booktics plugin <= 1.0.24 - Broken Access Control vulnerability
Summary
Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 20:09 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-62135",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T20:09:06.948369Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T20:19:10.946Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "booktics",
"product": "Booktics",
"vendor": "Arraytics",
"versions": [
{
"changes": [
{
"at": "1.0.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.0.24",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Supakiad S. (m3ez) | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated Broken Access Control in Booktics \u003c= 1.0.24 versions."
}
],
"value": "Unauthenticated Broken Access Control in Booktics \u003c= 1.0.24 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T18:12:11.688Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/booktics/vulnerability/wordpress-booktics-plugin-1-0-24-broken-access-control-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Booktics Plugin to the latest available version (at least 1.0.25)."
}
],
"value": "Update the WordPress Booktics Plugin to the latest available version (at least 1.0.25)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress Booktics plugin \u003c= 1.0.24 - Broken Access Control vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-62135",
"datePublished": "2026-09-11T18:12:11.688Z",
"dateReserved": "2026-07-13T06:15:23.737Z",
"dateUpdated": "2026-09-11T20:19:10.946Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-11446 (GCVE-0-2026-11446)
Vulnerability from nvd – Published: 2026-09-11 03:39 – Updated: 2026-09-11 16:37
VLAI
EPSS
VEX
Title
Booktics – Booking Calendar for Appointments and Service Businesses <= 1.0.23 - Missing Authorization
Summary
The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the create_order_permission() permission callback on the POST /wp-json/booktics/v1/orders REST route unconditionally returning true, combined with find_and_update_guest() overwriting an existing customer record's stored name, phone, and wp_user_id whenever the caller-supplied email matches, with no proof of ownership. This makes it possible for unauthenticated attackers to overwrite the contact details (name and phone) of any existing customer whose email address they know, poisoning downstream reminder emails, SMS, calendar invites, and CRM data.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 16:35 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| arraytics | Booktics – Appointment Booking Calendar for Service Businesses |
Affected:
0 , ≤ 1.0.23
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-11446",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T16:35:24.063578Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T16:37:36.654Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Booktics \u2013 Appointment Booking Calendar for Service Businesses",
"vendor": "arraytics",
"versions": [
{
"lessThanOrEqual": "1.0.23",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "revblock"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Booktics \u2013 Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the create_order_permission() permission callback on the POST /wp-json/booktics/v1/orders REST route unconditionally returning true, combined with find_and_update_guest() overwriting an existing customer record\u0027s stored name, phone, and wp_user_id whenever the caller-supplied email matches, with no proof of ownership. This makes it possible for unauthenticated attackers to overwrite the contact details (name and phone) of any existing customer whose email address they know, poisoning downstream reminder emails, SMS, calendar invites, and CRM data."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T03:39:38.143Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c86956bf-b013-4a84-b77e-8b1007238b27?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.21/core/order/controllers/order-controller.php#L172"
},
{
"url": "https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.21/core/order/controllers/order-controller.php#L885"
},
{
"url": "https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.18/core/order/controllers/order-controller.php#L172"
},
{
"url": "https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.18/core/order/controllers/order-controller.php#L863"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-06T10:02:44.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-10T14:53:08.000Z",
"value": "Disclosed"
}
],
"title": "Booktics \u2013 Booking Calendar for Appointments and Service Businesses \u003c= 1.0.23 - Missing Authorization"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-11446",
"datePublished": "2026-09-11T03:39:38.143Z",
"dateReserved": "2026-06-06T09:47:28.518Z",
"dateUpdated": "2026-09-11T16:37:36.654Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15398 (GCVE-0-2026-15398)
Vulnerability from nvd – Published: 2026-09-09 07:40 – Updated: 2026-09-09 14:02
VLAI
EPSS
VEX
Title
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption
Summary
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.22. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to bypass payment for paid events, fraudulently mark orders as completed, deplete ticket inventory, and trigger confirmation emails for tickets never purchased. This is exploitable by unauthenticated attackers because the wp_rest nonce is publicly emitted on every frontend page, and the order creation endpoint mints and returns an order_access_token to any caller possessing that nonce — giving unauthenticated users all credentials required to reach the privileged update_booking_status branch.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 14:02 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
14 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| arraytics | Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce |
Affected:
0 , ≤ 4.1.22
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15398",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T14:02:05.291171Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:02:17.022Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Eventin \u2013 Event Calendar, Tickets, Registration, Booking \u0026 WooCommerce",
"vendor": "arraytics",
"versions": [
{
"lessThanOrEqual": "4.1.22",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Eventin \u2013 Event Calendar, Event Registration, Tickets \u0026 Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.22. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to bypass payment for paid events, fraudulently mark orders as completed, deplete ticket inventory, and trigger confirmation emails for tickets never purchased. This is exploitable by unauthenticated attackers because the wp_rest nonce is publicly emitted on every frontend page, and the order creation endpoint mints and returns an order_access_token to any caller possessing that nonce \u2014 giving unauthenticated users all credentials required to reach the privileged update_booking_status branch."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T07:40:56.856Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dd7baa69-88f7-4546-96c8-4829a63d0a99?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/Order/OrderController.php#L926"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.16/core/Order/OrderController.php#L926"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.16/core/Order/OrderController.php#L768"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.16/core/Order/OrderController.php#L733"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.16/core/Order/OrderController.php#L440"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.16/utils/locale/vars.php#L35"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.16/base/Enqueue/frontend.php#L28"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/Order/OrderController.php#L768"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/Order/OrderController.php#L733"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/Order/OrderController.php#L440"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/utils/locale/vars.php#L35"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/base/Enqueue/frontend.php#L28"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3668637%40wp-event-solution\u0026new=3668637%40wp-event-solution"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-10T13:39:59.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-08T19:18:20.000Z",
"value": "Disclosed"
}
],
"title": "Eventin \u2013 Event Calendar, Event Registration, Tickets \u0026 Booking (AI Powered) \u003c= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15398",
"datePublished": "2026-09-09T07:40:56.856Z",
"dateReserved": "2026-07-10T13:24:49.959Z",
"dateUpdated": "2026-09-09T14:02:17.022Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-11821 (GCVE-0-2026-11821)
Vulnerability from nvd – Published: 2026-09-09 04:28 – Updated: 2026-09-09 16:03
VLAI
EPSS
VEX
Title
Eventin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint
Summary
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view, create, update, clone, and delete notification flow event automation workflows that should be restricted to administrators.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 15:49 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| arraytics | Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce |
Affected:
0 , ≤ 4.1.17
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-11821",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T15:49:50.407986Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T16:03:07.389Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Eventin \u2013 Event Calendar, Tickets, Registration, Booking \u0026 WooCommerce",
"vendor": "arraytics",
"versions": [
{
"lessThanOrEqual": "4.1.17",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sushi Com Abacate"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Eventin \u2013 Event Calendar, Event Registration, Tickets \u0026 Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view, create, update, clone, and delete notification flow event automation workflows that should be restricted to administrators."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T04:28:34.581Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/560a3102-c274-450f-9119-ea47ee2e7c65?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.17/vendor/themewinter/email-notification-sdk/src/Flow/FlowAPI.php#L66"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.18/vendor/themewinter/email-notification-sdk/src/Flow/FlowAPI.php#L66"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3612206/wp-event-solution/trunk/vendor/themewinter/email-notification-sdk/src/Flow/FlowAPI.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-09T18:01:27.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-08T16:23:30.000Z",
"value": "Disclosed"
}
],
"title": "Eventin \u003c= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-11821",
"datePublished": "2026-09-09T04:28:34.581Z",
"dateReserved": "2026-06-09T17:46:16.572Z",
"dateUpdated": "2026-09-09T16:03:07.389Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15667 (GCVE-0-2026-15667)
Vulnerability from nvd – Published: 2026-09-09 02:27 – Updated: 2026-09-09 15:01
VLAI
EPSS
VEX
Title
Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter
Summary
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The etn_manage_event capability is assigned to Contributors by default, meaning any Contributor-level user can set the malicious event_layout value via the REST API without any additional configuration.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 15:01 UTC
CWE
- CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| arraytics | Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce |
Affected:
0 , ≤ 4.1.22
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15667",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T15:01:50.698166Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T15:01:58.232Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Eventin \u2013 Event Calendar, Tickets, Registration, Booking \u0026 WooCommerce",
"vendor": "arraytics",
"versions": [
{
"lessThanOrEqual": "4.1.22",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Eventin \u2013 Event Calendar, Event Registration, Tickets \u0026 Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the \u0027event_layout\u0027 parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The etn_manage_event capability is assigned to Contributors by default, meaning any Contributor-level user can set the malicious event_layout value via the REST API without any additional configuration."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-98",
"description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T02:27:35.678Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c3001ec4-a1d8-43d7-8e0c-1fe2e4e7f314?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.17/core/event/template-functions.php#L480"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.17/core/event/Api/EventController.php#L2165"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.17/core/AccessControl/Permission.php#L298"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.17/core/event/Api/EventController.php#L814"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.17/base/post-model.php#L202"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3668637%40wp-event-solution\u0026new=3668637%40wp-event-solution"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-13T21:27:16.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-08T13:49:31.000Z",
"value": "Disclosed"
}
],
"title": "Eventin \u003c= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via \u0027event_layout\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15667",
"datePublished": "2026-09-09T02:27:35.678Z",
"dateReserved": "2026-07-13T21:12:06.098Z",
"dateUpdated": "2026-09-09T15:01:58.232Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15406 (GCVE-0-2026-15406)
Vulnerability from nvd – Published: 2026-09-09 02:27 – Updated: 2026-09-11 20:19
VLAI
EPSS
VEX
Title
Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter
Summary
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This makes it possible for authenticated attackers, with custom-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 20:10 UTC
CWE
- CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| arraytics | Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce |
Affected:
0 , ≤ 4.1.22
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15406",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T20:10:14.899267Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T20:19:15.061Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Eventin \u2013 Event Calendar, Tickets, Registration, Booking \u0026 WooCommerce",
"vendor": "arraytics",
"versions": [
{
"lessThanOrEqual": "4.1.22",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Eventin \u2013 Event Calendar, Event Registration, Tickets \u0026 Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the \u0027event_layout\u0027 parameter parameter. This makes it possible for authenticated attackers, with custom-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-98",
"description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T02:27:35.346Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a50b8e5c-d7f2-45d9-ba24-ea7a3d807deb?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/event/template-functions.php#L480"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.16/core/event/template-functions.php#L480"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.16/core/event/Api/EventController.php#L2165"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.16/core/event/Api/EventController.php#L1041"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.16/core/AccessControl/Permission.php#L297"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/event/Api/EventController.php#L2165"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/event/Api/EventController.php#L1041"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/AccessControl/Permission.php#L297"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3668637%40wp-event-solution\u0026new=3668637%40wp-event-solution"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-10T14:08:10.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-08T13:48:13.000Z",
"value": "Disclosed"
}
],
"title": "Eventin \u003c= 4.1.22 - Authenticated (Custom+) Local File Inclusion via \u0027event_layout\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15406",
"datePublished": "2026-09-09T02:27:35.346Z",
"dateReserved": "2026-07-10T13:53:01.204Z",
"dateUpdated": "2026-09-11T20:19:15.061Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12956 (GCVE-0-2026-12956)
Vulnerability from nvd – Published: 2026-09-09 02:27 – Updated: 2026-09-09 13:55
VLAI
EPSS
VEX
Title
Eventin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter
Summary
The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the create_item() handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's create_item_permissions_check() function only verifies a wp_rest nonce (which is leaked to every visitor through the etn-public script's localized_data_obj on every frontend page) and accepts a user-supplied 'status' value in prepare_item_for_database() with no whitelist validation. This makes it possible for unauthenticated attackers to create etn-order posts with status='completed' that are counted as sold by etn_get_sold_tickets_by_event(); because the auto-cleanup wp_schedule_single_event() in create_item() only fires for status='pending' orders, the forged completed orders persist indefinitely and exhaust ticket inventory.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 13:54 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| arraytics | Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce |
Affected:
0 , ≤ 4.1.22
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12956",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T13:54:47.100590Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:55:02.316Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Eventin \u2013 Event Calendar, Tickets, Registration, Booking \u0026 WooCommerce",
"vendor": "arraytics",
"versions": [
{
"lessThanOrEqual": "4.1.22",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the create_item() handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint\u0027s create_item_permissions_check() function only verifies a wp_rest nonce (which is leaked to every visitor through the etn-public script\u0027s localized_data_obj on every frontend page) and accepts a user-supplied \u0027status\u0027 value in prepare_item_for_database() with no whitelist validation. This makes it possible for unauthenticated attackers to create etn-order posts with status=\u0027completed\u0027 that are counted as sold by etn_get_sold_tickets_by_event(); because the auto-cleanup wp_schedule_single_event() in create_item() only fires for status=\u0027pending\u0027 orders, the forged completed orders persist indefinitely and exhaust ticket inventory."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T02:27:34.017Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5e87a9ac-e7c6-4622-b3e5-6e17e7664317?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/Order/OrderController.php#L1325"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/Order/OrderController.php#L733"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/Order/OrderController.php#L413"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/utils/locale/vars.php#L35"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/utils/helper.php#L4558"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3668637%40wp-event-solution\u0026new=3668637%40wp-event-solution"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-22T21:35:50.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-08T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Eventin \u003c= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via \u0027status\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-12956",
"datePublished": "2026-09-09T02:27:34.017Z",
"dateReserved": "2026-06-22T21:20:42.007Z",
"dateUpdated": "2026-09-09T13:55:02.316Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84215 (GCVE-0-2026-84215)
Vulnerability from nvd – Published: 2026-09-03 16:31 – Updated: 2026-09-03 17:49
VLAI
EPSS
VEX
Title
WordPress Timetics plugin <= 1.0.61 - Broken Access Control vulnerability
Summary
Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 17:49 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84215",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T17:49:33.678454Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T17:49:47.876Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "timetics",
"product": "Timetics",
"vendor": "Arraytics",
"versions": [
{
"changes": [
{
"at": "1.0.62",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.0.61",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "NamDang | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated Broken Access Control in Timetics \u003c= 1.0.61 versions."
}
],
"value": "Unauthenticated Broken Access Control in Timetics \u003c= 1.0.61 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T16:31:41.541Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/timetics/vulnerability/wordpress-timetics-plugin-1-0-61-broken-access-control-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Timetics plugin to the latest available version (at least 1.0.62)."
}
],
"value": "Update the WordPress Timetics plugin to the latest available version (at least 1.0.62)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress Timetics plugin \u003c= 1.0.61 - Broken Access Control vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-84215",
"datePublished": "2026-09-03T16:31:41.541Z",
"dateReserved": "2026-09-01T11:12:11.169Z",
"dateUpdated": "2026-09-03T17:49:47.876Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82223 (GCVE-0-2026-82223)
Vulnerability from nvd – Published: 2026-09-02 11:37 – Updated: 2026-09-02 16:00
VLAI
EPSS
VEX
Title
WordPress WP Event SOlution plugin <= 4.1.22 - Broken Access Control vulnerability
Summary
Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 13:43 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arraytics | WP Event SOlution |
Affected:
n/a , ≤ 4.1.22
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82223",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-02T13:43:57.242453Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T16:00:29.434Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "wp-event-solution",
"product": "WP Event SOlution",
"vendor": "Arraytics",
"versions": [
{
"changes": [
{
"at": "4.1.23",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.1.22",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "20kilograma | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated Broken Access Control in WP Event SOlution \u003c= 4.1.22 versions."
}
],
"value": "Unauthenticated Broken Access Control in WP Event SOlution \u003c= 4.1.22 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T11:37:31.194Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/wp-event-solution/vulnerability/wordpress-wp-event-solution-plugin-4-1-22-broken-access-control-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress WP Event SOlution Plugin to the latest available version (at least 4.1.23)."
}
],
"value": "Update the WordPress WP Event SOlution Plugin to the latest available version (at least 4.1.23)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress WP Event SOlution plugin \u003c= 4.1.22 - Broken Access Control vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-82223",
"datePublished": "2026-09-02T11:37:31.194Z",
"dateReserved": "2026-08-28T09:18:05.695Z",
"dateUpdated": "2026-09-02T16:00:29.434Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28174 (GCVE-0-2026-28174)
Vulnerability from nvd – Published: 2026-08-13 13:36 – Updated: 2026-08-13 15:18
VLAI
EPSS
VEX
Title
WordPress WP Event SOlution plugin <= 4.1.18 - Sensitive Data Exposure vulnerability
Summary
Customer Sensitive Data Exposure in WP Event SOlution <= 4.1.18 versions.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 15:07 UTC
CWE
- CWE-201 - Insertion of Sensitive Information Into Sent Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arraytics | WP Event SOlution |
Affected:
n/a , ≤ 4.1.18
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-28174",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T15:07:47.982599Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:18:37.853Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "wp-event-solution",
"product": "WP Event SOlution",
"vendor": "Arraytics",
"versions": [
{
"changes": [
{
"at": "4.1.19",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.1.18",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "VanTastic | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Customer Sensitive Data Exposure in WP Event SOlution \u003c= 4.1.18 versions."
}
],
"value": "Customer Sensitive Data Exposure in WP Event SOlution \u003c= 4.1.18 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-201",
"description": "CWE-201 Insertion of Sensitive Information Into Sent Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:36:33.789Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/wp-event-solution/vulnerability/wordpress-wp-event-solution-plugin-4-1-18-sensitive-data-exposure-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress WP Event SOlution plugin to the latest available version (at least 4.1.19)."
}
],
"value": "Update the WordPress WP Event SOlution plugin to the latest available version (at least 4.1.19)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress WP Event SOlution plugin \u003c= 4.1.18 - Sensitive Data Exposure vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-28174",
"datePublished": "2026-08-13T13:36:33.789Z",
"dateReserved": "2026-02-25T12:14:40.739Z",
"dateUpdated": "2026-08-13T15:18:37.853Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28173 (GCVE-0-2026-28173)
Vulnerability from nvd – Published: 2026-08-13 13:36 – Updated: 2026-08-13 15:48
VLAI
EPSS
VEX
Title
WordPress WP Event SOlution plugin <= 4.1.19 - Arbitrary Content Deletion vulnerability
Summary
Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 14:25 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arraytics | WP Event SOlution |
Affected:
n/a , ≤ 4.1.19
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-28173",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T14:25:10.966783Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:48:23.293Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "wp-event-solution",
"product": "WP Event SOlution",
"vendor": "Arraytics",
"versions": [
{
"changes": [
{
"at": "4.1.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.1.19",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "VanTastic | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Customer Arbitrary Content Deletion in WP Event SOlution \u003c= 4.1.19 versions."
}
],
"value": "Customer Arbitrary Content Deletion in WP Event SOlution \u003c= 4.1.19 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:36:33.153Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/wp-event-solution/vulnerability/wordpress-wp-event-solution-plugin-4-1-19-arbitrary-content-deletion-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Eventin plugin to the latest available version (at least 4.1.20)."
}
],
"value": "Update the WordPress Eventin plugin to the latest available version (at least 4.1.20)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress WP Event SOlution plugin \u003c= 4.1.19 - Arbitrary Content Deletion vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-28173",
"datePublished": "2026-08-13T13:36:33.153Z",
"dateReserved": "2026-02-25T12:14:40.738Z",
"dateUpdated": "2026-08-13T15:48:23.293Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28002 (GCVE-0-2026-28002)
Vulnerability from nvd – Published: 2026-08-13 13:42 – Updated: 2026-08-13 15:33 X_Open Source
VLAI
EPSS
VEX
Title
WordPress Booktics plugin 1.0.22 - SQL Injection vulnerability
Summary
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection.
This issue affects Booktics: from n/a through 1.0.22.
Severity
8.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 14:56 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-28002",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T14:56:27.863202Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:33:53.641Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "booktics",
"product": "Booktics",
"vendor": "Arraytics",
"versions": [
{
"changes": [
{
"at": "1.0.23",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.0.22",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Abdullah Kareem \"cyberkareem\" | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Arraytics Booktics allows Blind SQL Injection.\u003cp\u003eThis issue affects Booktics: from n/a through 1.0.22.\u003c/p\u003e"
}
],
"value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Arraytics Booktics allows Blind SQL Injection.\n\nThis issue affects Booktics: from n/a through 1.0.22."
}
],
"impacts": [
{
"capecId": "CAPEC-7",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-7 Blind SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:42:09.081Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/booktics/vulnerability/wordpress-booktics-plugin-1-0-22-sql-injection-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Booktics plugin to the latest available version (at least 1.0.23)."
}
],
"value": "Update the WordPress Booktics plugin to the latest available version (at least 1.0.23)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source"
],
"title": "WordPress Booktics plugin 1.0.22 - SQL Injection vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-28002",
"datePublished": "2026-08-13T13:42:09.081Z",
"dateReserved": "2026-02-25T12:12:58.154Z",
"dateUpdated": "2026-08-13T15:33:53.641Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66451 (GCVE-0-2026-66451)
Vulnerability from nvd – Published: 2026-08-06 14:27 – Updated: 2026-08-06 19:22
VLAI
EPSS
VEX
Title
WordPress WP Event SOlution plugin <= 4.1.9 - Broken Authentication vulnerability
Summary
Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 versions.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-06 19:22 UTC
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arraytics | WP Event SOlution |
Affected:
n/a , ≤ 4.1.9
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66451",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T19:22:01.013162Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T19:22:10.763Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "wp-event-solution",
"product": "WP Event SOlution",
"vendor": "Arraytics",
"versions": [
{
"changes": [
{
"at": "4.1.10",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.1.9",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Evan NR | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated Broken Authentication in WP Event SOlution \u003c= 4.1.9 versions."
}
],
"value": "Unauthenticated Broken Authentication in WP Event SOlution \u003c= 4.1.9 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-50",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-50 Password Recovery Exploitation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T14:27:51.339Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/wp-event-solution/vulnerability/wordpress-wp-event-solution-plugin-4-1-9-broken-authentication-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Eventin Plugin to the latest available version (at least 4.1.10)."
}
],
"value": "Update the WordPress Eventin Plugin to the latest available version (at least 4.1.10)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress WP Event SOlution plugin \u003c= 4.1.9 - Broken Authentication vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-66451",
"datePublished": "2026-08-06T14:27:51.339Z",
"dateReserved": "2026-07-27T09:00:28.156Z",
"dateUpdated": "2026-08-06T19:22:10.763Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13039 (GCVE-0-2026-13039)
Vulnerability from nvd – Published: 2026-07-10 20:31 – Updated: 2026-07-13 14:40
VLAI
EPSS
VEX
Title
Eventin 4.0.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API
Summary
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This is due to the plugin not properly verifying that a user is authorized to perform an action in the payment_complete() function of PaymentController.php. This makes it possible for unauthenticated attackers to mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash, granting themselves paid event access, QR-code attendee tickets, and order confirmation emails without making any real payment. The wp_rest nonce required to reach the vulnerable endpoint is embedded in every public event page, meaning no WordPress session or credentials are needed to obtain it. This vulnerability represents a regression — the same function and endpoint were previously patched but the fix did not persist through subsequent releases.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-13 14:36 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| arraytics | Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) |
Affected:
4.0.26 , ≤ 4.1.15
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13039",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-13T14:36:37.552409Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T14:40:09.826Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Eventin \u2013 Event Calendar, Event Registration, Tickets \u0026 Booking (AI Powered)",
"vendor": "arraytics",
"versions": [
{
"lessThanOrEqual": "4.1.15",
"status": "affected",
"version": "4.0.26",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Niv Kochan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Eventin \u2013 Event Calendar, Event Registration, Tickets \u0026 Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This is due to the plugin not properly verifying that a user is authorized to perform an action in the payment_complete() function of PaymentController.php. This makes it possible for unauthenticated attackers to mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash, granting themselves paid event access, QR-code attendee tickets, and order confirmation emails without making any real payment. The wp_rest nonce required to reach the vulnerable endpoint is embedded in every public event page, meaning no WordPress session or credentials are needed to obtain it. This vulnerability represents a regression \u2014 the same function and endpoint were previously patched but the fix did not persist through subsequent releases."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T20:31:37.672Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/84a5348a-a307-4db4-83b6-08682282a4b8?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3600977%40wp-event-solution\u0026new=3600977%40wp-event-solution"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-23T17:32:07.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-09T19:12:34.000Z",
"value": "Disclosed"
}
],
"title": "Eventin 4.0.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-13039",
"datePublished": "2026-07-10T20:31:37.672Z",
"dateReserved": "2026-06-23T17:16:57.845Z",
"dateUpdated": "2026-07-13T14:40:09.826Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12924 (GCVE-0-2026-12924)
Vulnerability from nvd – Published: 2026-07-10 07:48 – Updated: 2026-07-10 14:41
VLAI
EPSS
VEX
Title
Eventin <= 4.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn_faq_content' Parameter
Summary
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'etn_faq_content' parameter in all versions up to, and including, 4.1.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-10 14:40 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| arraytics | Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) |
Affected:
0 , ≤ 4.1.15
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12924",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-10T14:40:46.922796Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T14:41:37.142Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Eventin \u2013 Event Calendar, Event Registration, Tickets \u0026 Booking (AI Powered)",
"vendor": "arraytics",
"versions": [
{
"lessThanOrEqual": "4.1.15",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Eventin \u2013 Event Calendar, Event Registration, Tickets \u0026 Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027etn_faq_content\u0027 parameter in all versions up to, and including, 4.1.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T07:48:41.434Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/343ed594-482a-4a27-9682-92bb643ee82a?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/templates/event/parts/event-details-parts.php#L359"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/templates/event/parts/styles/event-faq/style-1.php#L27"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/templates/event/parts/styles/event-faq/style-2.php#L26"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/event/Api/EventController.php#L2027"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/utils/functions.php#L44"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/event/Api/EventController.php#L801"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3600977%40wp-event-solution\u0026new=3600977%40wp-event-solution"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-22T17:17:39.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-09T19:20:13.000Z",
"value": "Disclosed"
}
],
"title": "Eventin \u003c= 4.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027etn_faq_content\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-12924",
"datePublished": "2026-07-10T07:48:41.434Z",
"dateReserved": "2026-06-22T17:02:31.023Z",
"dateUpdated": "2026-07-10T14:41:37.142Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62135 (GCVE-0-2026-62135)
Vulnerability from cvelistv5 – Published: 2026-09-11 18:12 – Updated: 2026-09-11 20:19
VLAI
EPSS
VEX
Title
WordPress Booktics plugin <= 1.0.24 - Broken Access Control vulnerability
Summary
Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 20:09 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-62135",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T20:09:06.948369Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T20:19:10.946Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "booktics",
"product": "Booktics",
"vendor": "Arraytics",
"versions": [
{
"changes": [
{
"at": "1.0.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.0.24",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Supakiad S. (m3ez) | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated Broken Access Control in Booktics \u003c= 1.0.24 versions."
}
],
"value": "Unauthenticated Broken Access Control in Booktics \u003c= 1.0.24 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T18:12:11.688Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/booktics/vulnerability/wordpress-booktics-plugin-1-0-24-broken-access-control-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Booktics Plugin to the latest available version (at least 1.0.25)."
}
],
"value": "Update the WordPress Booktics Plugin to the latest available version (at least 1.0.25)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress Booktics plugin \u003c= 1.0.24 - Broken Access Control vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-62135",
"datePublished": "2026-09-11T18:12:11.688Z",
"dateReserved": "2026-07-13T06:15:23.737Z",
"dateUpdated": "2026-09-11T20:19:10.946Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-11446 (GCVE-0-2026-11446)
Vulnerability from cvelistv5 – Published: 2026-09-11 03:39 – Updated: 2026-09-11 16:37
VLAI
EPSS
VEX
Title
Booktics – Booking Calendar for Appointments and Service Businesses <= 1.0.23 - Missing Authorization
Summary
The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the create_order_permission() permission callback on the POST /wp-json/booktics/v1/orders REST route unconditionally returning true, combined with find_and_update_guest() overwriting an existing customer record's stored name, phone, and wp_user_id whenever the caller-supplied email matches, with no proof of ownership. This makes it possible for unauthenticated attackers to overwrite the contact details (name and phone) of any existing customer whose email address they know, poisoning downstream reminder emails, SMS, calendar invites, and CRM data.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 16:35 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| arraytics | Booktics – Appointment Booking Calendar for Service Businesses |
Affected:
0 , ≤ 1.0.23
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-11446",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T16:35:24.063578Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T16:37:36.654Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Booktics \u2013 Appointment Booking Calendar for Service Businesses",
"vendor": "arraytics",
"versions": [
{
"lessThanOrEqual": "1.0.23",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "revblock"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Booktics \u2013 Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the create_order_permission() permission callback on the POST /wp-json/booktics/v1/orders REST route unconditionally returning true, combined with find_and_update_guest() overwriting an existing customer record\u0027s stored name, phone, and wp_user_id whenever the caller-supplied email matches, with no proof of ownership. This makes it possible for unauthenticated attackers to overwrite the contact details (name and phone) of any existing customer whose email address they know, poisoning downstream reminder emails, SMS, calendar invites, and CRM data."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T03:39:38.143Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c86956bf-b013-4a84-b77e-8b1007238b27?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.21/core/order/controllers/order-controller.php#L172"
},
{
"url": "https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.21/core/order/controllers/order-controller.php#L885"
},
{
"url": "https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.18/core/order/controllers/order-controller.php#L172"
},
{
"url": "https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.18/core/order/controllers/order-controller.php#L863"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-06T10:02:44.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-10T14:53:08.000Z",
"value": "Disclosed"
}
],
"title": "Booktics \u2013 Booking Calendar for Appointments and Service Businesses \u003c= 1.0.23 - Missing Authorization"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-11446",
"datePublished": "2026-09-11T03:39:38.143Z",
"dateReserved": "2026-06-06T09:47:28.518Z",
"dateUpdated": "2026-09-11T16:37:36.654Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15398 (GCVE-0-2026-15398)
Vulnerability from cvelistv5 – Published: 2026-09-09 07:40 – Updated: 2026-09-09 14:02
VLAI
EPSS
VEX
Title
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption
Summary
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.22. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to bypass payment for paid events, fraudulently mark orders as completed, deplete ticket inventory, and trigger confirmation emails for tickets never purchased. This is exploitable by unauthenticated attackers because the wp_rest nonce is publicly emitted on every frontend page, and the order creation endpoint mints and returns an order_access_token to any caller possessing that nonce — giving unauthenticated users all credentials required to reach the privileged update_booking_status branch.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 14:02 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
14 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| arraytics | Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce |
Affected:
0 , ≤ 4.1.22
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15398",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T14:02:05.291171Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:02:17.022Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Eventin \u2013 Event Calendar, Tickets, Registration, Booking \u0026 WooCommerce",
"vendor": "arraytics",
"versions": [
{
"lessThanOrEqual": "4.1.22",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Eventin \u2013 Event Calendar, Event Registration, Tickets \u0026 Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.22. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to bypass payment for paid events, fraudulently mark orders as completed, deplete ticket inventory, and trigger confirmation emails for tickets never purchased. This is exploitable by unauthenticated attackers because the wp_rest nonce is publicly emitted on every frontend page, and the order creation endpoint mints and returns an order_access_token to any caller possessing that nonce \u2014 giving unauthenticated users all credentials required to reach the privileged update_booking_status branch."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T07:40:56.856Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dd7baa69-88f7-4546-96c8-4829a63d0a99?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/Order/OrderController.php#L926"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.16/core/Order/OrderController.php#L926"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.16/core/Order/OrderController.php#L768"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.16/core/Order/OrderController.php#L733"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.16/core/Order/OrderController.php#L440"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.16/utils/locale/vars.php#L35"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.16/base/Enqueue/frontend.php#L28"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/Order/OrderController.php#L768"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/Order/OrderController.php#L733"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/Order/OrderController.php#L440"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/utils/locale/vars.php#L35"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/base/Enqueue/frontend.php#L28"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3668637%40wp-event-solution\u0026new=3668637%40wp-event-solution"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-10T13:39:59.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-08T19:18:20.000Z",
"value": "Disclosed"
}
],
"title": "Eventin \u2013 Event Calendar, Event Registration, Tickets \u0026 Booking (AI Powered) \u003c= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15398",
"datePublished": "2026-09-09T07:40:56.856Z",
"dateReserved": "2026-07-10T13:24:49.959Z",
"dateUpdated": "2026-09-09T14:02:17.022Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-11821 (GCVE-0-2026-11821)
Vulnerability from cvelistv5 – Published: 2026-09-09 04:28 – Updated: 2026-09-09 16:03
VLAI
EPSS
VEX
Title
Eventin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint
Summary
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view, create, update, clone, and delete notification flow event automation workflows that should be restricted to administrators.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 15:49 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| arraytics | Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce |
Affected:
0 , ≤ 4.1.17
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-11821",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T15:49:50.407986Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T16:03:07.389Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Eventin \u2013 Event Calendar, Tickets, Registration, Booking \u0026 WooCommerce",
"vendor": "arraytics",
"versions": [
{
"lessThanOrEqual": "4.1.17",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sushi Com Abacate"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Eventin \u2013 Event Calendar, Event Registration, Tickets \u0026 Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view, create, update, clone, and delete notification flow event automation workflows that should be restricted to administrators."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T04:28:34.581Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/560a3102-c274-450f-9119-ea47ee2e7c65?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.17/vendor/themewinter/email-notification-sdk/src/Flow/FlowAPI.php#L66"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.18/vendor/themewinter/email-notification-sdk/src/Flow/FlowAPI.php#L66"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3612206/wp-event-solution/trunk/vendor/themewinter/email-notification-sdk/src/Flow/FlowAPI.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-09T18:01:27.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-08T16:23:30.000Z",
"value": "Disclosed"
}
],
"title": "Eventin \u003c= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-11821",
"datePublished": "2026-09-09T04:28:34.581Z",
"dateReserved": "2026-06-09T17:46:16.572Z",
"dateUpdated": "2026-09-09T16:03:07.389Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15667 (GCVE-0-2026-15667)
Vulnerability from cvelistv5 – Published: 2026-09-09 02:27 – Updated: 2026-09-09 15:01
VLAI
EPSS
VEX
Title
Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter
Summary
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The etn_manage_event capability is assigned to Contributors by default, meaning any Contributor-level user can set the malicious event_layout value via the REST API without any additional configuration.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 15:01 UTC
CWE
- CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| arraytics | Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce |
Affected:
0 , ≤ 4.1.22
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15667",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T15:01:50.698166Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T15:01:58.232Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Eventin \u2013 Event Calendar, Tickets, Registration, Booking \u0026 WooCommerce",
"vendor": "arraytics",
"versions": [
{
"lessThanOrEqual": "4.1.22",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Eventin \u2013 Event Calendar, Event Registration, Tickets \u0026 Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the \u0027event_layout\u0027 parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The etn_manage_event capability is assigned to Contributors by default, meaning any Contributor-level user can set the malicious event_layout value via the REST API without any additional configuration."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-98",
"description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T02:27:35.678Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c3001ec4-a1d8-43d7-8e0c-1fe2e4e7f314?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.17/core/event/template-functions.php#L480"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.17/core/event/Api/EventController.php#L2165"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.17/core/AccessControl/Permission.php#L298"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.17/core/event/Api/EventController.php#L814"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.17/base/post-model.php#L202"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3668637%40wp-event-solution\u0026new=3668637%40wp-event-solution"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-13T21:27:16.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-08T13:49:31.000Z",
"value": "Disclosed"
}
],
"title": "Eventin \u003c= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via \u0027event_layout\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15667",
"datePublished": "2026-09-09T02:27:35.678Z",
"dateReserved": "2026-07-13T21:12:06.098Z",
"dateUpdated": "2026-09-09T15:01:58.232Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15406 (GCVE-0-2026-15406)
Vulnerability from cvelistv5 – Published: 2026-09-09 02:27 – Updated: 2026-09-11 20:19
VLAI
EPSS
VEX
Title
Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter
Summary
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This makes it possible for authenticated attackers, with custom-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 20:10 UTC
CWE
- CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| arraytics | Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce |
Affected:
0 , ≤ 4.1.22
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15406",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T20:10:14.899267Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T20:19:15.061Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Eventin \u2013 Event Calendar, Tickets, Registration, Booking \u0026 WooCommerce",
"vendor": "arraytics",
"versions": [
{
"lessThanOrEqual": "4.1.22",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Eventin \u2013 Event Calendar, Event Registration, Tickets \u0026 Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the \u0027event_layout\u0027 parameter parameter. This makes it possible for authenticated attackers, with custom-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-98",
"description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T02:27:35.346Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a50b8e5c-d7f2-45d9-ba24-ea7a3d807deb?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/event/template-functions.php#L480"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.16/core/event/template-functions.php#L480"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.16/core/event/Api/EventController.php#L2165"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.16/core/event/Api/EventController.php#L1041"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.16/core/AccessControl/Permission.php#L297"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/event/Api/EventController.php#L2165"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/event/Api/EventController.php#L1041"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/AccessControl/Permission.php#L297"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3668637%40wp-event-solution\u0026new=3668637%40wp-event-solution"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-10T14:08:10.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-08T13:48:13.000Z",
"value": "Disclosed"
}
],
"title": "Eventin \u003c= 4.1.22 - Authenticated (Custom+) Local File Inclusion via \u0027event_layout\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15406",
"datePublished": "2026-09-09T02:27:35.346Z",
"dateReserved": "2026-07-10T13:53:01.204Z",
"dateUpdated": "2026-09-11T20:19:15.061Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12956 (GCVE-0-2026-12956)
Vulnerability from cvelistv5 – Published: 2026-09-09 02:27 – Updated: 2026-09-09 13:55
VLAI
EPSS
VEX
Title
Eventin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter
Summary
The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the create_item() handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's create_item_permissions_check() function only verifies a wp_rest nonce (which is leaked to every visitor through the etn-public script's localized_data_obj on every frontend page) and accepts a user-supplied 'status' value in prepare_item_for_database() with no whitelist validation. This makes it possible for unauthenticated attackers to create etn-order posts with status='completed' that are counted as sold by etn_get_sold_tickets_by_event(); because the auto-cleanup wp_schedule_single_event() in create_item() only fires for status='pending' orders, the forged completed orders persist indefinitely and exhaust ticket inventory.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 13:54 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| arraytics | Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce |
Affected:
0 , ≤ 4.1.22
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12956",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T13:54:47.100590Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:55:02.316Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Eventin \u2013 Event Calendar, Tickets, Registration, Booking \u0026 WooCommerce",
"vendor": "arraytics",
"versions": [
{
"lessThanOrEqual": "4.1.22",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the create_item() handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint\u0027s create_item_permissions_check() function only verifies a wp_rest nonce (which is leaked to every visitor through the etn-public script\u0027s localized_data_obj on every frontend page) and accepts a user-supplied \u0027status\u0027 value in prepare_item_for_database() with no whitelist validation. This makes it possible for unauthenticated attackers to create etn-order posts with status=\u0027completed\u0027 that are counted as sold by etn_get_sold_tickets_by_event(); because the auto-cleanup wp_schedule_single_event() in create_item() only fires for status=\u0027pending\u0027 orders, the forged completed orders persist indefinitely and exhaust ticket inventory."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T02:27:34.017Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5e87a9ac-e7c6-4622-b3e5-6e17e7664317?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/Order/OrderController.php#L1325"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/Order/OrderController.php#L733"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/Order/OrderController.php#L413"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/utils/locale/vars.php#L35"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/utils/helper.php#L4558"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3668637%40wp-event-solution\u0026new=3668637%40wp-event-solution"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-22T21:35:50.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-08T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Eventin \u003c= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via \u0027status\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-12956",
"datePublished": "2026-09-09T02:27:34.017Z",
"dateReserved": "2026-06-22T21:20:42.007Z",
"dateUpdated": "2026-09-09T13:55:02.316Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84215 (GCVE-0-2026-84215)
Vulnerability from cvelistv5 – Published: 2026-09-03 16:31 – Updated: 2026-09-03 17:49
VLAI
EPSS
VEX
Title
WordPress Timetics plugin <= 1.0.61 - Broken Access Control vulnerability
Summary
Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 17:49 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84215",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T17:49:33.678454Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T17:49:47.876Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "timetics",
"product": "Timetics",
"vendor": "Arraytics",
"versions": [
{
"changes": [
{
"at": "1.0.62",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.0.61",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "NamDang | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated Broken Access Control in Timetics \u003c= 1.0.61 versions."
}
],
"value": "Unauthenticated Broken Access Control in Timetics \u003c= 1.0.61 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T16:31:41.541Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/timetics/vulnerability/wordpress-timetics-plugin-1-0-61-broken-access-control-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Timetics plugin to the latest available version (at least 1.0.62)."
}
],
"value": "Update the WordPress Timetics plugin to the latest available version (at least 1.0.62)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress Timetics plugin \u003c= 1.0.61 - Broken Access Control vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-84215",
"datePublished": "2026-09-03T16:31:41.541Z",
"dateReserved": "2026-09-01T11:12:11.169Z",
"dateUpdated": "2026-09-03T17:49:47.876Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82223 (GCVE-0-2026-82223)
Vulnerability from cvelistv5 – Published: 2026-09-02 11:37 – Updated: 2026-09-02 16:00
VLAI
EPSS
VEX
Title
WordPress WP Event SOlution plugin <= 4.1.22 - Broken Access Control vulnerability
Summary
Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 13:43 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arraytics | WP Event SOlution |
Affected:
n/a , ≤ 4.1.22
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82223",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-02T13:43:57.242453Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T16:00:29.434Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "wp-event-solution",
"product": "WP Event SOlution",
"vendor": "Arraytics",
"versions": [
{
"changes": [
{
"at": "4.1.23",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.1.22",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "20kilograma | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated Broken Access Control in WP Event SOlution \u003c= 4.1.22 versions."
}
],
"value": "Unauthenticated Broken Access Control in WP Event SOlution \u003c= 4.1.22 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T11:37:31.194Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/wp-event-solution/vulnerability/wordpress-wp-event-solution-plugin-4-1-22-broken-access-control-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress WP Event SOlution Plugin to the latest available version (at least 4.1.23)."
}
],
"value": "Update the WordPress WP Event SOlution Plugin to the latest available version (at least 4.1.23)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress WP Event SOlution plugin \u003c= 4.1.22 - Broken Access Control vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-82223",
"datePublished": "2026-09-02T11:37:31.194Z",
"dateReserved": "2026-08-28T09:18:05.695Z",
"dateUpdated": "2026-09-02T16:00:29.434Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28002 (GCVE-0-2026-28002)
Vulnerability from cvelistv5 – Published: 2026-08-13 13:42 – Updated: 2026-08-13 15:33 X_Open Source
VLAI
EPSS
VEX
Title
WordPress Booktics plugin 1.0.22 - SQL Injection vulnerability
Summary
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection.
This issue affects Booktics: from n/a through 1.0.22.
Severity
8.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 14:56 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-28002",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T14:56:27.863202Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:33:53.641Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "booktics",
"product": "Booktics",
"vendor": "Arraytics",
"versions": [
{
"changes": [
{
"at": "1.0.23",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.0.22",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Abdullah Kareem \"cyberkareem\" | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Arraytics Booktics allows Blind SQL Injection.\u003cp\u003eThis issue affects Booktics: from n/a through 1.0.22.\u003c/p\u003e"
}
],
"value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Arraytics Booktics allows Blind SQL Injection.\n\nThis issue affects Booktics: from n/a through 1.0.22."
}
],
"impacts": [
{
"capecId": "CAPEC-7",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-7 Blind SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:42:09.081Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/booktics/vulnerability/wordpress-booktics-plugin-1-0-22-sql-injection-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Booktics plugin to the latest available version (at least 1.0.23)."
}
],
"value": "Update the WordPress Booktics plugin to the latest available version (at least 1.0.23)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source"
],
"title": "WordPress Booktics plugin 1.0.22 - SQL Injection vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-28002",
"datePublished": "2026-08-13T13:42:09.081Z",
"dateReserved": "2026-02-25T12:12:58.154Z",
"dateUpdated": "2026-08-13T15:33:53.641Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28174 (GCVE-0-2026-28174)
Vulnerability from cvelistv5 – Published: 2026-08-13 13:36 – Updated: 2026-08-13 15:18
VLAI
EPSS
VEX
Title
WordPress WP Event SOlution plugin <= 4.1.18 - Sensitive Data Exposure vulnerability
Summary
Customer Sensitive Data Exposure in WP Event SOlution <= 4.1.18 versions.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 15:07 UTC
CWE
- CWE-201 - Insertion of Sensitive Information Into Sent Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arraytics | WP Event SOlution |
Affected:
n/a , ≤ 4.1.18
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-28174",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T15:07:47.982599Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:18:37.853Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "wp-event-solution",
"product": "WP Event SOlution",
"vendor": "Arraytics",
"versions": [
{
"changes": [
{
"at": "4.1.19",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.1.18",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "VanTastic | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Customer Sensitive Data Exposure in WP Event SOlution \u003c= 4.1.18 versions."
}
],
"value": "Customer Sensitive Data Exposure in WP Event SOlution \u003c= 4.1.18 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-201",
"description": "CWE-201 Insertion of Sensitive Information Into Sent Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:36:33.789Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/wp-event-solution/vulnerability/wordpress-wp-event-solution-plugin-4-1-18-sensitive-data-exposure-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress WP Event SOlution plugin to the latest available version (at least 4.1.19)."
}
],
"value": "Update the WordPress WP Event SOlution plugin to the latest available version (at least 4.1.19)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress WP Event SOlution plugin \u003c= 4.1.18 - Sensitive Data Exposure vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-28174",
"datePublished": "2026-08-13T13:36:33.789Z",
"dateReserved": "2026-02-25T12:14:40.739Z",
"dateUpdated": "2026-08-13T15:18:37.853Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28173 (GCVE-0-2026-28173)
Vulnerability from cvelistv5 – Published: 2026-08-13 13:36 – Updated: 2026-08-13 15:48
VLAI
EPSS
VEX
Title
WordPress WP Event SOlution plugin <= 4.1.19 - Arbitrary Content Deletion vulnerability
Summary
Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 14:25 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arraytics | WP Event SOlution |
Affected:
n/a , ≤ 4.1.19
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-28173",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T14:25:10.966783Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:48:23.293Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "wp-event-solution",
"product": "WP Event SOlution",
"vendor": "Arraytics",
"versions": [
{
"changes": [
{
"at": "4.1.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.1.19",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "VanTastic | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Customer Arbitrary Content Deletion in WP Event SOlution \u003c= 4.1.19 versions."
}
],
"value": "Customer Arbitrary Content Deletion in WP Event SOlution \u003c= 4.1.19 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:36:33.153Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/wp-event-solution/vulnerability/wordpress-wp-event-solution-plugin-4-1-19-arbitrary-content-deletion-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Eventin plugin to the latest available version (at least 4.1.20)."
}
],
"value": "Update the WordPress Eventin plugin to the latest available version (at least 4.1.20)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress WP Event SOlution plugin \u003c= 4.1.19 - Arbitrary Content Deletion vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-28173",
"datePublished": "2026-08-13T13:36:33.153Z",
"dateReserved": "2026-02-25T12:14:40.738Z",
"dateUpdated": "2026-08-13T15:48:23.293Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66451 (GCVE-0-2026-66451)
Vulnerability from cvelistv5 – Published: 2026-08-06 14:27 – Updated: 2026-08-06 19:22
VLAI
EPSS
VEX
Title
WordPress WP Event SOlution plugin <= 4.1.9 - Broken Authentication vulnerability
Summary
Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 versions.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-06 19:22 UTC
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arraytics | WP Event SOlution |
Affected:
n/a , ≤ 4.1.9
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66451",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T19:22:01.013162Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T19:22:10.763Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "wp-event-solution",
"product": "WP Event SOlution",
"vendor": "Arraytics",
"versions": [
{
"changes": [
{
"at": "4.1.10",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.1.9",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Evan NR | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated Broken Authentication in WP Event SOlution \u003c= 4.1.9 versions."
}
],
"value": "Unauthenticated Broken Authentication in WP Event SOlution \u003c= 4.1.9 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-50",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-50 Password Recovery Exploitation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T14:27:51.339Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/wp-event-solution/vulnerability/wordpress-wp-event-solution-plugin-4-1-9-broken-authentication-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Eventin Plugin to the latest available version (at least 4.1.10)."
}
],
"value": "Update the WordPress Eventin Plugin to the latest available version (at least 4.1.10)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress WP Event SOlution plugin \u003c= 4.1.9 - Broken Authentication vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-66451",
"datePublished": "2026-08-06T14:27:51.339Z",
"dateReserved": "2026-07-27T09:00:28.156Z",
"dateUpdated": "2026-08-06T19:22:10.763Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13039 (GCVE-0-2026-13039)
Vulnerability from cvelistv5 – Published: 2026-07-10 20:31 – Updated: 2026-07-13 14:40
VLAI
EPSS
VEX
Title
Eventin 4.0.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API
Summary
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This is due to the plugin not properly verifying that a user is authorized to perform an action in the payment_complete() function of PaymentController.php. This makes it possible for unauthenticated attackers to mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash, granting themselves paid event access, QR-code attendee tickets, and order confirmation emails without making any real payment. The wp_rest nonce required to reach the vulnerable endpoint is embedded in every public event page, meaning no WordPress session or credentials are needed to obtain it. This vulnerability represents a regression — the same function and endpoint were previously patched but the fix did not persist through subsequent releases.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-13 14:36 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| arraytics | Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) |
Affected:
4.0.26 , ≤ 4.1.15
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13039",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-13T14:36:37.552409Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T14:40:09.826Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Eventin \u2013 Event Calendar, Event Registration, Tickets \u0026 Booking (AI Powered)",
"vendor": "arraytics",
"versions": [
{
"lessThanOrEqual": "4.1.15",
"status": "affected",
"version": "4.0.26",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Niv Kochan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Eventin \u2013 Event Calendar, Event Registration, Tickets \u0026 Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This is due to the plugin not properly verifying that a user is authorized to perform an action in the payment_complete() function of PaymentController.php. This makes it possible for unauthenticated attackers to mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash, granting themselves paid event access, QR-code attendee tickets, and order confirmation emails without making any real payment. The wp_rest nonce required to reach the vulnerable endpoint is embedded in every public event page, meaning no WordPress session or credentials are needed to obtain it. This vulnerability represents a regression \u2014 the same function and endpoint were previously patched but the fix did not persist through subsequent releases."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T20:31:37.672Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/84a5348a-a307-4db4-83b6-08682282a4b8?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3600977%40wp-event-solution\u0026new=3600977%40wp-event-solution"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-23T17:32:07.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-09T19:12:34.000Z",
"value": "Disclosed"
}
],
"title": "Eventin 4.0.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-13039",
"datePublished": "2026-07-10T20:31:37.672Z",
"dateReserved": "2026-06-23T17:16:57.845Z",
"dateUpdated": "2026-07-13T14:40:09.826Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12924 (GCVE-0-2026-12924)
Vulnerability from cvelistv5 – Published: 2026-07-10 07:48 – Updated: 2026-07-10 14:41
VLAI
EPSS
VEX
Title
Eventin <= 4.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn_faq_content' Parameter
Summary
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'etn_faq_content' parameter in all versions up to, and including, 4.1.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-10 14:40 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| arraytics | Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) |
Affected:
0 , ≤ 4.1.15
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12924",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-10T14:40:46.922796Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T14:41:37.142Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Eventin \u2013 Event Calendar, Event Registration, Tickets \u0026 Booking (AI Powered)",
"vendor": "arraytics",
"versions": [
{
"lessThanOrEqual": "4.1.15",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Eventin \u2013 Event Calendar, Event Registration, Tickets \u0026 Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027etn_faq_content\u0027 parameter in all versions up to, and including, 4.1.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T07:48:41.434Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/343ed594-482a-4a27-9682-92bb643ee82a?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/templates/event/parts/event-details-parts.php#L359"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/templates/event/parts/styles/event-faq/style-1.php#L27"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/templates/event/parts/styles/event-faq/style-2.php#L26"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/event/Api/EventController.php#L2027"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/utils/functions.php#L44"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-event-solution/tags/4.1.15/core/event/Api/EventController.php#L801"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3600977%40wp-event-solution\u0026new=3600977%40wp-event-solution"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-22T17:17:39.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-09T19:20:13.000Z",
"value": "Disclosed"
}
],
"title": "Eventin \u003c= 4.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027etn_faq_content\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-12924",
"datePublished": "2026-07-10T07:48:41.434Z",
"dateReserved": "2026-06-22T17:02:31.023Z",
"dateUpdated": "2026-07-10T14:41:37.142Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}