CVE-2026-77702 — Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_token

CVE-2026-77702

Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_token PUBLISHED

Description (CNA)

The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge.

Affected (CNA)

Vendor / product	Versions
Unknown / Eventin	affected 0 before 4.1.24

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/a4fa75f7-2b30-4659-9e25-dd3454c50ebb/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.