CVE-2026-15398 is an authorization bypass vulnerability (CWE-862) in the Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce WordPress plugin. The plugin fails to properly verify user authorization for certain actions, enabling authenticated users with minimal privileges to perform unauthorized operations such as bypassing payment, marking orders as completed fraudulently, depleting ticket inventory, and sending confirmation emails for unpurchased tickets. The vulnerability is further exacerbated by the exposure of the wp_rest nonce on all frontend pages, allowing unauthenticated attackers to obtain an order_access_token from the order creation endpoint. This token enables access to privileged update_booking_status functionality without proper authorization checks. The CVSS v3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and low privileges required.

Attackers can bypass payment mechanisms for paid events, manipulate order statuses to mark them as completed fraudulently, exhaust ticket inventories, and trigger confirmation emails for tickets that were never purchased. This can lead to financial loss for event organizers and disruption of ticket sales. Both authenticated users with subscriber-level access and unauthenticated attackers can exploit this vulnerability due to exposed tokens and insufficient authorization checks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's REST endpoints and consider disabling the plugin if possible. Monitor for updates from the vendor and apply patches promptly once released.