CVE-2026-77694 — Eventin < 4.1.19 - Unauthenticated Order Completion Without Payment via order_token
The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users t…
Published: 2026-08-26 · CVSS: 5.3 · CVSS 3.1
The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7