CVE-2026-40776

Eventin (wp-event-solution) Broken Access Control

Unauthenticated PII disclosure and order forgery in the Eventin WordPress plugin (10,000+ active installs). A public REST endpoint hands out a wp_rest nonce to any visitor, and three downstream permission callbacks accept that nonce as a substitute for authentication — collapsing authorization on every customer order endpoint.

Full technical writeup: https://lorenzofradeani.com/en/blog/cve-2026-40776 Patchstack advisory: https://patchstack.com/database/wordpress/plugin/wp-event-solution/vulnerability/wordpress-eventin-plugin-4-1-8-broken-access-control-vulnerability

At a glance

Summary

Three issues compose into a complete authorization bypass:

1. Public nonce dispenser. core/Admin/hooks.php (lines 68–77) registers /wp-json/eventin/v1/nonce with permission_callback => '__return_true' and returns a freshly minted wp_rest nonce to any unauthenticated caller.
2. Nonce-as-auth permission callbacks. Three controllers in core/Order/ accept that nonce as the only authorization check:
   • OrderController::get_item_permissions_check (lines 146–148) — current_user_can(...) || wp_verify_nonce(...) ; the || makes the nonce alone sufficient.
   • OrderController::create_item_permissions_check (lines 476–478) — wp_verify_nonce(...) only.
   • PaymentController::create_payment_permission_check (lines 66–70) — only.

End-to-end, four unauthenticated requests are enough to dump every customer order (full names, emails, phone numbers, payment methods, attendees roster) and to forge new orders. See ADVISORY.md for the full technical breakdown and poc/poc-eventin.sh for a reproducible PoC.

Mitigation

Update wp-event-solution to 4.1.9 or later. There is no in-version workaround for older releases short of disabling the plugin or blocking the affected REST routes (/wp-json/eventin/v1/nonce, /wp-json/eventin/v2/orders*, /wp-json/eventin/v2/payments, /wp-json/eventin/v2/orders/book-seats) at the web-server / WAF layer.

Repository contents

.
├── README.md                       this file
├── ADVISORY.md                     full technical advisory + code review
├── LICENSE                         MIT
├── poc/
│   └── poc-eventin.sh              4-step bash PoC against a local lab
└── screenshots/
    ├── poc1-idor-pii-leak.png      IDOR read of order #21 with full PII
    ├── poc2-no-nonce-blocked.png   same request without nonce → 401
    └── poc3-fake-order-created.png unauthenticated POST creating a fake order

Disclosure timeline

References

• Full writeup (canonical): https://lorenzofradeani.com/en/blog/cve-2026-40776
• Patchstack advisory: https://patchstack.com/database/wordpress/plugin/wp-event-solution/vulnerability/wordpress-eventin-plugin-4-1-8-broken-access-control-vulnerability
• Plugin on wordpress.org: https://wordpress.org/plugins/wp-event-solution/
• CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html

Responsible use

This material is published for defensive and educational purposes — to help WordPress site operators identify exposure, to help plugin authors avoid the same mistake (treating a CSRF nonce as authentication), and to document a real-world example of how the || short-circuit in a permission callback collapses authorization. Do not run the PoC against systems you do not own or do not have explicit written authorization to test.

License

MIT