Eventin CVE-2026-84907

Exploitation requires the site to have Eventin's offline (local) payment method enabled - a non-default gating configuration - and at least one existing order to target. The vulnerable finalisation route relies on a nonce the plugin exposes to unauthenticated visitors, so no login is needed (PR:N), but AC:H reflects that the attacker must act against a specific configuration and an existing order rather than a default install. Impact is limited to integrity (I:L): resetting orders/attendees to pending and invalidating paid tickets; there is no data disclosure (C:N) or service outage (A:N). Fixed in Eventin 4.1.24.

This is a genuine but low-priority issue. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N = 3.7) captures it well: network-reachable and unauthenticated, but confidentiality and availability are untouched and the only impact is a low integrity effect (resetting order/attendee status). AC:H is justified because exploitation is gated on a specific non-default deployment state (the offline/local payment method must be enabled) and on the existence of a target order to reset. EPSS agrees this is not a mass-exploitation candidate (0.18%, 8th percentile), and there is no CISA KEV listing, so there is no evidence of active exploitation. A publicly available exploit exists (WPScan write-up), which raises the practical likelihood of opportunistic abuse against exposed shops, but POC availability is a distinct signal from active exploitation and must not be conflated. The 'Authentication Bypass' tag overstates the class: the root cause is missing authorization (CWE-862) - the endpoint is intended to be reachable by unauthenticated visitors, but the caller is never checked to own the order. Net: a real, patch-worthy authorization flaw with low blast radius, appropriate for routine patching rather than emergency response.

On an event site running Eventin with offline (local) payment enabled, an unauthenticated attacker reuses the order-finalisation nonce the plugin exposes to anonymous visitors and calls the finalisation route against an order ID they do not own. Because ownership is never validated, the targeted order and its attendees are reset to a pending state, invalidating already-paid tickets. A public WPScan proof-of-concept exists, and no authentication or user interaction is required.