Eventin (wp-event-solution) Broken Access Control / IDOR (CVE-2026-40776)

Metadata

Affected Target

Summary

The Eventin WordPress plugin (10,000+ active installs) exposes a public REST endpoint, /wp-json/eventin/v1/nonce, that hands a valid wp_rest nonce to any unauthenticated visitor. Three separate REST controllers then treat possession of that nonce as sufficient authorization — one via a short-circuiting current_user_can(...) || wp_verify_nonce(...) check, two via wp_verify_nonce(...) alone with no capability check at all. Combined with an IDOR on the order-read endpoint (no ownership verification against sequential post IDs) and a fully open seat-booking endpoint (permission_callback hardcoded to true), any unauthenticated attacker can chain four requests to dump every customer order’s PII (names, emails, phone numbers, payment methods, attendee rosters) and to forge new orders or exhaust event seats. The root cause is conflating a CSRF nonce (which is not user-identity-bound) with authentication.

Vulnerability Details

Root Cause

core/Admin/hooks.php registers /wp-json/eventin/v1/nonce with permission_callback => '__return_true', publicly issuing a wp_rest nonce; OrderController and PaymentController then accept that nonce (via wp_verify_nonce) as a substitute for a capability check in their *_permissions_check methods, and get_item loads orders by raw post ID with no ownership check.

Attack Vector

1. Request /wp-json/eventin/v1/nonce (unauthenticated) to obtain a valid wp_rest nonce.
2. Use the nonce as the X-WP-Nonce header to call OrderController::get_item with sequential order IDs, reading full customer PII without authentication (IDOR).
3. Use the same nonce to call the order-creation and payment endpoints, forging arbitrary orders/payments.
4. Call the fully open /book-seats endpoint (no permission check at all) to reserve or exhaust event seats.

Impact

Unauthenticated disclosure of all customer order PII across an Eventin-powered site, plus the ability to forge orders/payments and exhaust seat-limited events — a complete authorization bypass on the plugin’s order/payment subsystem.

Environment / Lab Setup

Target:   WordPress 6.7 + Eventin (wp-event-solution) <= 4.1.8, default configuration
Attacker: bash, curl (see poc/poc-eventin.sh)

Proof of Concept

PoC Script

See poc/poc-eventin.sh and ADVISORY.md in this folder.

1

./poc/poc-eventin.sh <target-url>

The script performs the four-step unauthenticated chain against a local lab: fetch a public wp_rest nonce, use it to read an existing order’s full PII via IDOR, demonstrate that the same request is rejected (401) without the nonce, and then use the nonce to create a forged order — matching the screenshots referenced in the upstream README (poc1-idor-pii-leak, poc2-no-nonce-blocked, poc3-fake-order-created).

Detection & Indicators of Compromise

Signs of compromise:

• Bulk sequential requests to /wp-json/eventin/v2/orders/{id} from anonymous clients
• Unexpected orders/payments created without a corresponding logged-in session
• Seat-booking endpoint hit at high volume from a single source

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/lorenzofradeani/CVE-2026-40776 on 2026-07-05.