Eventin CVE-2026-84906

Exploitation requires a WordPress site running Eventin before 4.1.24 with an online payment gateway actively enabled in the ticket/order checkout flow, and the plugin's payment confirmation endpoint must be reachable by unauthenticated visitors - which the supplied CVSS vector (PR:N, UI:N) indicates. The attacker must first possess at least one genuine, gateway-confirmed successful transaction reference originating from that same site and gateway, something they can obtain themselves by completing a minimum-value purchase; without such a reference the replay has nothing valid to submit. Limiting factors: sites that take only offline or bank-transfer payments, or that complete settlement inside another system with its own order-level validation, are not exposed; sites that manually verify each payment against the gateway's own transaction records before releasing tickets or goods neutralise the financial impact even while unpatched; and the flaw causes no data disclosure or availability loss, so it is purely an order-state and revenue integrity issue.

CVSS 3.1 scores this 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) - a medium-severity finding driven entirely by a low integrity impact, with no confidentiality or availability effect, which arithmetic understates the financial consequences of free high-value bookings. The vector's PR:N/UI:N metrics indicate the attack is network-reachable without credentials or victim interaction, and WPScan's advisory contains exploit detail, so publicly available exploit code exists; the operation is inexpensive to automate (make one minimum-value purchase, then replay the reference against high-value orders), and no KEV listing or EPSS score was supplied, so active exploitation is unconfirmed and the probability signal is missing - this absence should not be read as evidence of low risk. In SSVC terms this looks like PoC/automatable/partial technical impact, i.e. a patch-soon rather than emergency item for most sites, but any operator monetising tickets or bookings should treat order-value fraud as a direct revenue loss: even a mid-sized municipal IT team in kalisz running an event-registration portal should treat this as urgent, because a single replayed transaction can void the payment on unlimited orders. Missing or conflicting data to resolve: no CWE assigned, no EPSS score, no KEV status beyond what the input omits, and the CPE vendor field is 'unknown'.

An attacker places the cheapest possible order on a vulnerable Eventin site, completes a genuine low-value payment through the integrated gateway, and captures the resulting success reference or callback. They then replay that reference against a high-value unpaid order (for example a premium conference package or a large block of tickets), and the plugin records it as paid without any funds being transferred. No authentication or victim interaction is required, and published exploit detail lowers the barrier for less-skilled attackers.