EUVD-2026-66284
GHSA-rh58-q787-q9gq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess Eventin guest checkout
-
DeliveryInitiate unpaid ticket order
-
ExploitCapture issued guest checkout token
-
ExecutionSend crafted token-authenticated order-completion request
-
PersistServer transitions order to completed
-
ImpactValid paid ticket issued with no payment processed
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required for network reachability - the attack targets the publicly accessible guest checkout endpoint of any WordPress site running Eventin below 4.1.19. The attacker must initiate a real order to obtain a valid guest checkout token for their order; they cannot manipulate other users' orders. Exploitation is therefore scoped to self-service ticket fraud (one attacker, one or more free tickets per order), not unauthorized access to other customers' data. Guest checkout must be available and the site must use Eventin's order-based ticketing flow. No authentication, admin interaction, or non-default configuration is required beyond the plugin being installed and active. |
| Impact | The NVD CVSS score of 5.3 (Medium, I:L) materially understates real-world impact: each successful exploit represents direct financial loss to event organizers via fraudulent ticket issuance. SSVC rates the attack as automatable with no exploitation currently confirmed, meaning a scripted campaign could generate unlimited free tickets at volume. EPSS sits at just 0.17% (6th percentile) despite a public proof-of-concept, suggesting exploitation has not yet become widespread - but the zero-auth, zero-interaction, network-accessible attack surface and public exploit mean the window before active campaigns emerge may be short. The absence from CISA KEV is noted, though it does not diminish urgency given automation potential. Any operator running ticket sales through Eventin on an unpatched installation faces immediate fraud exposure. |
| Exploit ScenarioDerived | An attacker initiates a ticket purchase for a paid event, proceeds through guest checkout, and captures the order token returned for their unpaid order. Using the publicly available proof-of-concept documented by WPScan, they craft an API request with that token to set the order status to completed, bypassing the payment gateway entirely. The Eventin plugin then issues a valid, scannable ticket - the attacker gains event entry or resells the ticket with zero payment made. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Unauthenticated payment bypass in the Eventin WordPress plugin before 4.1.19 lets any visitor fraudulently obtain valid paid event tickets without completing payment. By abusing a guest checkout token, an attacker can transition their own unpaid order to 'completed', triggering ticket issuance without a charge being processed. A publicly available proof-of-concept exists, and SSVC flags the attack as automatable - enabling scaled ticket fraud against any WordPress site running the affected plugin.
RemediationAI
Update the Eventin plugin to version 4.1.19 or later via the WordPress plugin dashboard or manually from the plugin repository; version 4.1.19 is the vendor-released fix per the WPScan advisory at https://wpscan.com/vulnerability/2670eac4-b630-4546-9b56-f19feabfa550/. If an immediate update is not possible, disabling the guest checkout feature within Eventin settings (if exposed as a toggle) eliminates the vulnerable code path at the cost of requiring all purchasers to register an account before checkout. Site owners should audit recent orders marked 'completed' with no corresponding payment record to identify fraudulently obtained tickets and revoke them. Generic WAF rules cannot reliably block this business-logic flaw, as the malicious request is structurally identical to a legitimate token-authenticated order interaction.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Eventin is a WordPress event management and ticketing plugin (CPE: cpe:2.3:a:unknown:eventin:*:*:*:*:*:*:*:*). The plugin provides a guest checkout flow that issues per-order tokens so unauthenticated users can interact with their own orders. The root cause is CWE-862 (Missing Authorization): the authorization check validates token ownership but fails to restrict which order state transitions that token may authorize. Specifically, the token can drive an order from 'unpaid' to 'completed' - a transition that should only be triggered by the payment gateway after a successful charge. This is a server-side business logic flaw, not a client-side bypass or token forgery.
Know when Eventin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Fully network-exploitable with no authentication; integrity rated High because the flaw enables complete payment bypass and creation of fraudulent valid paid records, exceeding the vendor I:L rating.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Incorrect Privilege Assignment vulnerability in Themewinter Eventin allows Privilege Escalation.0.26. Rated critical sev
Unauthenticated account creation in the Eventin WordPress plugin (all versions before 4.1.20) allows any remote attacker
Eventin WordPress plugin versions before 4.1.20 exposes stored customer records - including names and email addresses -
Relative Path Traversal vulnerability in Themewinter Eventin allows Path Traversal.0.26. Rated high severity (CVSS 7.5),
Broken authorization in the Eventin WordPress plugin before 4.1.16 lets unauthenticated visitors create orders and suppl
Local file inclusion in the Eventin WordPress plugin (all versions before 4.1.20) allows authenticated users holding edi
Eventin WordPress plugin versions from 4.1.9 through 4.1.19 exposes customer order records - including personal informat
Local file inclusion in Eventin WordPress plugin before 4.1.21 enables authenticated contributors and higher-privileged
Missing authorization in the Eventin WordPress plugin before 4.1.24 allows unauthenticated attackers to reuse the order-
Unauthenticated information disclosure in the Eventin WordPress plugin before 4.1.22 exposes private, draft, and pending
Unauthenticated visitors can mark unpaid Eventin orders of any value as paid by replaying a single genuine low-value pay
Missing authorization on Eventin's event-management REST routes allows low-privilege WordPress contributors to perform i
Exploit-DB