CVE-2026-13178 — Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation
The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create or…
Published: 2026-07-30 · CVSS: 7.5 · CVSS 3.1
The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7