CVE-2026-13178 is an unauthenticated broken object-level authorization vulnerability in the Eventin WordPress plugin (event management/ticketing), specifically in an AJAX order creation endpoint. An attacker can submit arbitrary order data including a client-controlled status parameter directly to the AJAX handler, bypassing any authorization checks that may exist on the plugin's public-facing checkout form. The vulnerability received a CVSS 7.5, reflecting the straightforward exploitability: no authentication required, and the attacker-supplied status value flows directly into the order record.
The pattern here — an AJAX endpoint treated as an internal API that only the plugin's own JavaScript would call — is a documented anti-pattern in WordPress plugin security. The mental model of 'this endpoint receives my own frontend's data' is understandable but dangerous because WordPress AJAX handlers are publicly routable regardless of where the request originates. The fix in version 4.1.16 should include both capability verification (verifying the user has permission to create orders) and input validation (whitelisting allowed status values), not just one or the other.
If you're running Eventin, update to 4.1.16 immediately. Beyond patching, audit any other AJAX endpoints in your plugins for the same pattern: handlers registered with wp_ajax_* or wp_ajax_nopriv_* that process user input without explicit authorization checks at the handler entry point. The fact that this class of vulnerability consistently recurs across the WordPress plugin ecosystem — not just in Eventin — means the presence of one such endpoint in any plugin you maintain should trigger a systematic review of all AJAX handlers, not a one-off fix.