medium5.3
CVE-2026-77694
The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauth…
Impact
The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken.
Affected products
| Product | Affected versions |
|---|---|
| Eventin WordPress Plugin | before 4.1.19 |
Versions were read from the advisory text. No structured product data has been published for this record yet.