EUVD-2026-80219
GHSA-8p6x-g49r-wjj7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Replay is network-reachable with no credentials or interaction, but the attacker must first obtain a valid gateway reference, so AC:L with only I:L impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the payment gateway reports the transaction as successful, not its amount, currency, or which order it belongs to, allowing unauthenticated visitors to mark unpaid orders of any value as paid by replaying the transaction of a single genuine low-value payment.
AnalysisAI
Unauthenticated visitors can mark unpaid Eventin orders of any value as paid by replaying a single genuine low-value payment transaction, because the plugin only checks that the gateway reports success and never validates the amount, currency, or which order the transaction belongs to. The flaw affects WordPress sites running the Eventin event-management plugin before version 4.1.24, and exploit detail is publicly available via the WPScan advisory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a WordPress site running Eventin before 4.1.24 with an online payment gateway actively enabled in the ticket/order checkout flow, and the plugin's payment confirmation endpoint must be reachable by unauthenticated visitors - which the supplied CVSS vector (PR:N, UI:N) indicates. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.1 scores this 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) - a medium-severity finding driven entirely by a low integrity impact, with no confidentiality or availability effect, which arithmetic understates the financial consequences of free high-value bookings. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 4.1.24 - Eventin sites should be updated to 4.1.24 or later immediately via the WordPress dashboard or the plugin's wordpress.org repository entry. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Incorrect Privilege Assignment vulnerability in Themewinter Eventin allows Privilege Escalation.0.26. Rated critical sev
Unauthenticated account creation in the Eventin WordPress plugin (all versions before 4.1.20) allows any remote attacker
Eventin WordPress plugin versions before 4.1.20 exposes stored customer records - including names and email addresses -
Relative Path Traversal vulnerability in Themewinter Eventin allows Path Traversal.0.26. Rated high severity (CVSS 7.5),
Broken authorization in the Eventin WordPress plugin before 4.1.16 lets unauthenticated visitors create orders and suppl
Local file inclusion in the Eventin WordPress plugin (all versions before 4.1.20) allows authenticated users holding edi
Eventin WordPress plugin versions from 4.1.9 through 4.1.19 exposes customer order records - including personal informat
Local file inclusion in Eventin WordPress plugin before 4.1.21 enables authenticated contributors and higher-privileged
Unauthenticated information disclosure in the Eventin WordPress plugin before 4.1.22 exposes private, draft, and pending
Unauthenticated payment bypass in the Eventin WordPress plugin before 4.1.19 lets any visitor fraudulently obtain valid
Missing authorization on Eventin's event-management REST routes allows low-privilege WordPress contributors to perform i
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to Local File In
Share
External POC / Exploit Code
Leaving vuln.today