5.3
Medium
CVE-2026-77694 The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed…
Description
The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Eventin 4.1 | earliest → < 4.1.19 | 4.1.19 |
Other CVEs of Eventin
The 18 CVEs of Eventin →
CVE-2026-84906
The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is…
5.3
Medium
CVE-2026-84907
The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline (local)…
3.7
Low
CVE-2026-84905
The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a…
2.7
Low
CVE-2026-77702
The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used…
5.3
Medium