Eventin CVE-2026-77702

Incorrect Privilege Assignment vulnerability in Themewinter Eventin allows Privilege Escalation.0.26. Rated critical sev

Unauthenticated account creation in the Eventin WordPress plugin (all versions before 4.1.20) allows any remote attacker

Eventin WordPress plugin versions before 4.1.20 exposes stored customer records - including names and email addresses -

Relative Path Traversal vulnerability in Themewinter Eventin allows Path Traversal.0.26. Rated high severity (CVSS 7.5),

Broken authorization in the Eventin WordPress plugin before 4.1.16 lets unauthenticated visitors create orders and suppl

Local file inclusion in the Eventin WordPress plugin (all versions before 4.1.20) allows authenticated users holding edi

Eventin WordPress plugin versions from 4.1.9 through 4.1.19 exposes customer order records - including personal informat

Local file inclusion in Eventin WordPress plugin before 4.1.21 enables authenticated contributors and higher-privileged

Unauthenticated information disclosure in the Eventin WordPress plugin before 4.1.22 exposes private, draft, and pending

Unauthenticated payment bypass in the Eventin WordPress plugin before 4.1.19 lets any visitor fraudulently obtain valid

Unauthenticated visitors can mark unpaid Eventin orders of any value as paid by replaying a single genuine low-value pay

Missing authorization on Eventin's event-management REST routes allows low-privilege WordPress contributors to perform i