The Eventin WordPress plugin contains a regression that removes the user capability check in the payment_complete() endpoint. Because the endpoint accepts a payment identifier or cart hash and marks the corresponding order as completed without verifying the user’s permission, any request can be forged. An attacker can create a fake SureCart checkout ID or a FluentCart cart hash, submit it to the REST API, and the plugin will treat the order as paid. This results in the attacker receiving full event access, QR-code entry passes, and order confirmation emails without having paid, effectively bypassing the payment system.

WordPress sites running the Eventin plugin between versions 4.0.26 and 4.1.15 inclusively are affected. These versions are distributed by arraytics under the event-calendar and booking product line. The flaw exists regardless of user role; unauthenticated users can exploit it because the required wp_rest nonce is embedded in every public event page.

The CVSS score of 5.3 indicates a medium severity impact. The flaw is exploitable by sending a crafted request to the public REST endpoint without needing authentication, as the nonce is publicly EPSS score is less than 1 % and the vulnerability is not listed in CISA’s KEV catalog, yet the combination of unauthenticated to alter order status poses a tangible threat to sites that rely on paid events for revenue.