CVE-2026-13039 is an authorization bypass vulnerability in the Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) WordPress plugin by arraytics. Versions from 4.0.26 through 4.1.15 improperly verify user authorization in the payment_complete() function of PaymentController.php, allowing unauthenticated attackers to mark unpaid ticket orders as completed by submitting fabricated SureCart checkout IDs or FluentCart cart hashes. The wp_rest nonce needed to access the vulnerable endpoint is embedded in every public event page, so no WordPress session or credentials are required. This vulnerability is a regression, as the same function and endpoint were previously patched but the fix did not persist in subsequent releases.

An attacker can bypass authorization to mark unpaid ticket orders as completed, granting themselves paid event access, QR-code attendee tickets, and order confirmation emails without making any payment. This compromises the integrity of the ticketing system and can lead to revenue loss and unauthorized event attendance. The vulnerability does not impact confidentiality or availability but impacts integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the payment_complete() endpoint or implementing additional authorization checks as a temporary mitigation.