[CVE-2026-13178] The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts a…

Descripción técnica

The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment.

Puntuación CVSS

Score: 7.5/10 — Severidad: HIGH — Estado NIST: Deferred

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Debilidades (CWE)

CWE-639

Fuente oficial

Publicado en NIST NVD.