CVE-2025-1766: Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status Update
First published: Thu Mar 20 2025(Updated: )
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'payment_complete' function in all versions up to, and including, 4.0.24. This makes it possible for unauthenticated attackers to update the status of ticket payments to 'completed', possibly resulting in financial loss.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Eventin Event Manager | <=4.0.24 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-1766?
CVE-2025-1766 has a medium severity level due to the potential for unauthorized data modification.
How do I fix CVE-2025-1766?
To fix CVE-2025-1766, update the Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin to version 4.0.25 or later.
What causes the vulnerability in CVE-2025-1766?
CVE-2025-1766 is caused by a missing capability check on the 'payment_complete' function.
Who is affected by CVE-2025-1766?
CVE-2025-1766 affects all versions of the Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin up to and including 4.0.24.
What can an attacker do with CVE-2025-1766?
An attacker exploiting CVE-2025-1766 can modify data unauthorizedly within the plugin.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/references
- agent/first-publish-date
- agent/type
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/author
- agent/source
- agent/severity
- agent/tags
- agent/event
- vendor/eventin
- canonical/eventin event manager