CVE-2026-40776

CVE-2026-40776 Eventin wp-event-solution Broken Access Control Unauthenticated PII disclosure and order forgery in the Eventin WordPress plugin 10,000+ active installs. A public REST endpoint hands out a wprest nonce to any visitor, and three downstream permission callbacks accept that nonce as a...