CVE-2026-77694 — Eventin < 4.1.19 - Unauthenticated Order Completion Without Payment via order_token

CVE-2026-77694

Eventin < 4.1.19 - Unauthenticated Order Completion Without Payment via order_token PUBLISHED

Description (CNA)

The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken.

Affected (CNA)

Vendor / product	Versions
Unknown / Eventin	affected 0 before 4.1.19

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/2670eac4-b630-4546-9b56-f19feabfa550/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.