CVE-2026-77694: Eventin < 4.1.19 - Unauthenticated Order Completion Without Payment via order_token
The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Eventin WordPress pluginto a version that resolves this vulnerability.Fixed in 4.1.19 - Configuration
Ensure the guest checkout token is properly restricted to only the allowed changes for an order; prevent unauthenticated users from using the order_token to mark unpaid orders as completed and receive paid tickets without payment.
Eventin WordPress plugin Restrict guest checkout token authorisation scope = authorise only permitted order changes
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated user who can create their own unpaid order and obtain that order's guest checkout token can exploit it. The issue is limited to changes made to that user's own order through the token.
What is the impact of a successful exploit?
The attacker can mark an unpaid order as completed and receive a valid paid ticket without payment being taken.
Which plugin versions are affected?
Eventin versions before 4.1.19 are affected. Updating to version 4.1.19 or later addresses the affected version range.