EUVD-2026-66284
GHSA-rh58-q787-q9gq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Fully network-exploitable with no authentication; integrity rated High because the flaw enables complete payment bypass and creation of fraudulent valid paid records, exceeding the vendor I:L rating.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken.
AnalysisAI
Unauthenticated payment bypass in the Eventin WordPress plugin before 4.1.19 lets any visitor fraudulently obtain valid paid event tickets without completing payment. By abusing a guest checkout token, an attacker can transition their own unpaid order to 'completed', triggering ticket issuance without a charge being processed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required for network reachability - the attack targets the publicly accessible guest checkout endpoint of any WordPress site running Eventin below 4.1.19. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS score of 5.3 (Medium, I:L) materially understates real-world impact: each successful exploit represents direct financial loss to event organizers via fraudulent ticket issuance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker initiates a ticket purchase for a paid event, proceeds through guest checkout, and captures the order token returned for their unpaid order. Using the publicly available proof-of-concept documented by WPScan, they craft an API request with that token to set the order status to completed, bypassing the payment gateway entirely. … |
| Remediation | Update the Eventin plugin to version 4.1.19 or later via the WordPress plugin dashboard or manually from the plugin repository; version 4.1.19 is the vendor-released fix per the WPScan advisory at https://wpscan.com/vulnerability/2670eac4-b630-4546-9b56-f19feabfa550/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated account creation in the Eventin WordPress plugin (all versions before 4.1.20) allows any remote attacker
Eventin WordPress plugin versions before 4.1.20 exposes stored customer records - including names and email addresses -
Broken authorization in the Eventin WordPress plugin before 4.1.16 lets unauthenticated visitors create orders and suppl
Local file inclusion in the Eventin WordPress plugin (all versions before 4.1.20) allows authenticated users holding edi
Eventin WordPress plugin versions from 4.1.9 through 4.1.19 exposes customer order records - including personal informat
Unauthenticated information disclosure in the Eventin WordPress plugin before 4.1.22 exposes private, draft, and pending
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to Local File In
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to Local File In
Reflected cross-site scripting in the Eventin WordPress plugin up to version 4.0.28 allows unauthenticated attackers to
Blind server-side request forgery in the Eventin WordPress plugin prior to version 4.1.21 allows contributor-level authe
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themewinter
The Event Manager, Events Calendar, Events Tickets for WooCommerce - Eventin plugin for WordPress is vulnerable to unaut
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today