Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-15398

CVE-2026-15398MEDIUM

arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce — Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  N  L  N    4.3   .0029   19.9     —

AFFECTED
  Product                                                                 Versions     Fixed
  Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce  unspecified  —

TIMELINE
  Jul 10  Reserved by Wordfence
  Sep 9   Published (CNA: Wordfence)
  Oct 16  REJECTED — CVE-2026-15398 (arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce). Record withdrawn by the CNA.

CWE-862 · CNA: Wordfence · CVSS v3.1 · 14 references · NVD status: Rejected

Description

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-82223 Reason: This candidate is a reservation duplicate of CVE-2026-82223. Notes: All CVE users should reference CVE-2026-82223 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
July 10, 2026	Reserved	Reserved by Wordfence
September 9, 2026	Published	Published (CNA: Wordfence)
October 16, 2026	REJECTED	REJECTED — CVE-2026-15398 (arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce). Record withdrawn by the CNA.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
arraytics	Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce	—	—	—

Weaknesses

CWE-862

References (14)

Authoritative record: CVE-2026-15398 at cve.org

Vendors: arraytics

Weaknesses: CWE-862

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-15398 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.