5.3
Medium
CVE-2026-77702 The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used…
Description
The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Eventin 4.1 | earliest → < 4.1.24 | 4.1.24 |
Other CVEs of Eventin
The 18 CVEs of Eventin →
CVE-2026-84906
The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is…
5.3
Medium
CVE-2026-84907
The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline (local)…
3.7
Low
CVE-2026-84905
The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a…
2.7
Low
CVE-2026-84901
The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management…
4.9
Medium