CVE-2026-77694
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Eventin WordPress plugin before version 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order. This allows unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken.
Risk Assessment
The risk includes financial losses for event organizers, as attackers can obtain paid tickets without paying. This could also lead to integrity issues in the ticketing system.
Recommendation
Update the Eventin plugin to version 4.1.19 or later. Also review the checkout process and ensure guest tokens have appropriate restrictions.
Other vulnerabilities in Eventin
See all- CVE-2026-13172Medium
The Eventin WordPress plugin before version 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces. This allows unauthenticated users to retrieve draft, pending and private posts belonging to other users, along with the passwords and contents of password-protected ones.
- CVE-2026-13176Low
The Eventin WordPress plugin before version 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts.
- CVE-2026-13177Medium
The Eventin WordPress plugin before version 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers.
- CVE-2026-13171High
The Eventin WordPress plugin before version 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records.
- CVE-2026-13168Medium
The Eventin WordPress plugin before version 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses.
- CVE-2026-13178High
The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status. Unauthenticated users can create orders marked as paid without completing any payment.
- CVE-2026-13039Medium
The Eventin plugin for WordPress (versions 4.0.26 to 4.1.15) has an authorization bypass vulnerability in the payment_complete() function of PaymentController.php. Unauthenticated attackers can mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash, gaining paid event access, QR-code tickets, and confirmation emails without any payment.
- CVE-2026-12924Medium
The Eventin plugin for WordPress (versions up to and including 4.1.15) is vulnerable to stored XSS via the 'etn_faq_content' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute whenever a user visits an affected page.
Original NVD description (English source)
The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken.