CVE-2025-1766: Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status Update
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'paymentcomplete' function in all versions up to, and including, 4.0.24. This makes it possible for unauthenticated attackers to update the status of ticket payments to 'completed', possibly resulting in financial loss.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1766?
CVE-2025-1766 has a medium severity level due to the potential for unauthorized data modification.
How do I fix CVE-2025-1766?
To fix CVE-2025-1766, update the Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin to version 4.0.25 or later.
What causes the vulnerability in CVE-2025-1766?
CVE-2025-1766 is caused by a missing capability check on the 'payment_complete' function.
Who is affected by CVE-2025-1766?
CVE-2025-1766 affects all versions of the Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin up to and including 4.0.24.
What can an attacker do with CVE-2025-1766?
An attacker exploiting CVE-2025-1766 can modify data unauthorizedly within the plugin.