Answer in brief
CVE-2026-12956 records a Medium severity (CVSS 5.3) vulnerability in Eventin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter. The current sources do not mark it as known exploited. The current feed maps arraytics/Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce (generic), arraytics/Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps arraytics/Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce (generic), arraytics/Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| arraytics/Eventin – Event Calendar, Tickets, Registration, Booking & WooCommercegeneric | >=0 <=4.1.22 | Not reported |
| arraytics/Eventin – Event Calendar, Tickets, Registration, Booking & WooCommercegeneric | 0 | Not reported |
Published upstream
Sep 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 9, 2026
The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the create_item() handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's create_item_permissions_check() function only verifies a wp_rest nonce (which is leaked to every visitor through the etn-public script's localized_data_obj on every frontend page) and accepts a user-supplied 'status' value in prepare_item_for_database() with no whitelist validation. This makes it possible for unauthenticated attackers to create etn-order posts with status='completed' that are counted as sold by etn_get_sold_tickets_by_event(); because the auto-cleanup wp_schedule_single_event() in create_item() only fires for status='pending' orders, the forged completed orders persist indefinitely and exhaust ticket inventory.
Quoted source text, attributed separately from HOL analysis.