CVE-2026-77702 — Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_token
The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthen…
Published: 2026-09-16 · CVSS: 5.3 · CVSS 3.1
The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7