CVE-2026-84906: Eventin < 4.1.24 - Unauthenticated Payment Bypass via Stripe and PayPal Cross-Order Transaction Replay
The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the payment gateway reports the transaction as successful, not its amount, currency, or which order it belongs to, allowing unauthenticated visitors to mark unpaid orders of any value as paid by replaying the transaction of a single genuine low-value payment.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using Eventin versions earlier than 4.1.24 and accepting payments through Stripe or PayPal are exposed. Unauthenticated visitors can exploit the issue.
What does an attacker need to bypass payment?
The attacker needs a successful transaction from a genuine low-value payment that can be replayed. They can then use that transaction to mark an unpaid order of any value as paid.
What payment checks are missing?
Affected versions confirm only that the gateway reports a transaction as successful. They do not verify that the transaction belongs to the target order or that its amount and currency match the order.