CVE-2026-77694
Eventin < 4.1.19 - Unauthenticated Order Completion Without Payment via order_token
CVSS Score
5.3
EPSS Score
0.2%
EPSS Percentile
6th
The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken.
| Vendor | unknown |
| Product | eventin |
| Published | Aug 26, 2026 |
| Last Updated | Aug 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown eventin
Be the first to know when new medium vulnerabilities affecting unknown eventin are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Eventin
0 < 4.1.19
References
Credits
Nir Yehoshua WPScan