Missing Authorization in WP Event Solution Plugin for WordPress

CVE-2026-12956

What is CVE-2026-12956?

The WP Event Solution (Eventin) plugin for WordPress has a security flaw that allows unauthenticated users to exploit the /wp-json/eventin/v2/orders REST endpoint. This vulnerability arises from inadequate authorization checks in the create_item_permissions_check() function, which only verifies a wp_rest nonce that is publicly accessible. Attackers can manipulate the 'status' field in a request to create fraudulent orders marked as 'completed', thereby bypassing stock management. This results in unauthorized orders being recorded indefinitely, potentially leading to inventory depletion and dissatisfied customers.

References