CVE-2026-13039 describes an authorization bypass vulnerability (CWE-862) in the Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) WordPress plugin. The issue arises from improper authorization checks in the payment_complete() function of PaymentController.php in versions 4.0.26 up to and including 4.1.15. Attackers can exploit this by submitting fabricated SureCart checkout IDs or FluentCart cart hashes, allowing them to mark unpaid ticket orders as completed without authentication. The required wp_rest nonce is publicly accessible on event pages, requiring no WordPress session or credentials. This vulnerability is a regression, as the same function and endpoint were previously patched but the fix did not persist in subsequent releases.

An attacker can gain unauthorized paid event access, receive QR-code attendee tickets, and obtain order confirmation emails without making any real payment. This compromises the integrity of the ticketing and event registration process, potentially leading to revenue loss and unauthorized event attendance. There is no impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor for vendor updates and consider disabling or restricting access to the vulnerable payment_complete() endpoint until a fix is available.