Eventin CVE-2026-77702

Requires that the target site runs the Eventin plugin (before 4.1.24) with paid ticketing/checkout enabled, since the abuse targets the guest-checkout order flow. No authentication, user interaction, or non-default configuration is otherwise needed: the attacker acts as an ordinary anonymous buyer and reuses the order-scoped checkout token the plugin itself issues during guest checkout. The practical limiters are that exploitation only yields free tickets on that attacker's own order (integrity/fraud impact only - no data disclosure, no site takeover, no denial of service) and that the site must actually sell paid tickets for the flaw to have monetary value.

This is a genuine but moderate-severity business-logic flaw, best characterized as a real fraud/revenue-loss issue rather than a system-compromise one. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N = 5.3) is internally consistent with the description: the exploit is network-reachable, low-complexity, requires no authentication (the attacker simply reuses the guest-checkout token they legitimately receive) and no user interaction, and the only impact is a Low integrity effect (an order record is altered to swap a paid ticket for a free one). There is NO confidentiality or availability impact, which correctly caps the score in the medium range despite the unauthenticated/no-interaction profile. EPSS is low at 0.18% (8th percentile) and there is NO CISA KEV listing, indicating no evidence of widespread or automated exploitation - expected, since this is a targeted, per-order fraud technique rather than a mass-exploitable memory-corruption or takeover bug. A public WPScan exploit reference DOES exist, so exploitation is straightforward for anyone motivated to defraud a specific Eventin-powered store; however, POC availability is a distinct signal from active exploitation and should not be conflated. SSVC framing: exploitation is proof-of-concept, the technique is arguably automatable against a known target, but technical impact is partial (integrity-only). Net: prioritize patching for sites that actually sell tickets through Eventin (direct monetary loss), but this is not an emergency system-compromise vulnerability.

An attacker begins a normal guest checkout for a paid event ticket, obtaining the checkout token the plugin issues. Using that same token after checkout - which the plugin fails to prevent - they modify the pending order to substitute a free ticket for the paid one, then complete the order and receive a valid ticket at no cost. A public exploit reference is available via WPScan, making the technique reproducible against any unpatched Eventin store.