3.7
Faible
CVE-2026-84907 The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline (local)…
Description
The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline (local) payment method is enabled, relying on a nonce that is exposed to unauthenticated visitors and never checking that the caller owns the order, allowing unauthenticated attackers to reset any existing order and its attendees to a pending state and thereby invalidate paid tickets.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Eventin 4.1 | 4.1.5 → < 4.1.24 | 4.1.24 |
Références
- wpscan.com wpscan.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Eventin
Les 18 CVE de Eventin →
CVE-2026-84906
The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is…
5.3
Moyenne
CVE-2026-84905
The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a…
2.7
Faible
CVE-2026-77702
The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used…
5.3
Moyenne
CVE-2026-84901
The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management…
4.9
Moyenne