Security Advisory

CVE-2026-13178

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-07-30 06:00:11

Last updated 2026-07-30 17:09:31

Assigner WPScan

CVSS score not scored

State PUBLISHED

Description

The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment.

← Browse all CVEs View on cve.org ↗