EUVD-2026-51009
GHSA-5mvv-43fh-86fq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Eventin <4.1.16
-
DeliverySend unauthenticated order-creation request
-
ExploitSupply attacker-controlled paid status
-
ExecutionServer creates order without payment
-
ImpactObtain fraudulent paid order/tickets
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Exploitation requires that the target runs the Eventin WordPress plugin at a version below 4.1.16 with its order-creation endpoint reachable over the network (default for a public WordPress site). The attack needs no authentication, no user interaction, and no special configuration - the attacker simply supplies the order-status parameter that the endpoint improperly trusts. Limiting factors: the site must actually have Eventin installed and active and expose the vulnerable endpoint publicly; impact is confined to order/payment-status integrity (creating fraudulent paid orders) with no confidentiality or availability effect, so it does not yield code execution or data disclosure. |
| Impact | The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) reflects a network-reachable, low-complexity, unauthenticated integrity attack with no confidentiality or availability impact - consistent with forging paid orders rather than data theft. SSVC aligns with this: exploitation 'poc', automatable 'yes', technical impact 'partial'. However, EPSS is only 0.15% (4th percentile) and the CVE is NOT in CISA KEV, indicating no observed mass exploitation despite public POC availability - the automatable-yes rating suggests it could be scripted if attackers target Eventin sites. Note a data inconsistency: the tags label this 'Information Disclosure', but both the description and the CVSS vector (C:N, I:H) indicate an integrity/business-logic issue (fraudulent paid orders), not disclosure - treat the 'Information Disclosure' tag as a mislabel. Overall this is a moderate, targeted-fraud risk rather than a wormable critical, but the low barrier to exploitation warrants prompt patching on affected sites. |
| Exploit ScenarioDerived | An attacker sends a crafted unauthenticated HTTP request to Eventin's order-creation endpoint, including an 'order status' value set to paid/completed, and receives a fully-paid order (e.g., event tickets) without submitting any payment. Because a public POC exists and no authentication or user interaction is required, this can be scripted against any vulnerable site to obtain goods/tickets for free or to pollute order records. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Broken authorization in the Eventin WordPress plugin before 4.1.16 lets unauthenticated visitors create orders and supply their own order status, marking those orders as paid without ever completing payment. Because the order-creation endpoint neither authorizes the requester nor validates the payment state, remote attackers can forge fully-paid transactions, undermining ticket/event revenue integrity. Publicly available exploit code exists (reported by WPScan), though EPSS remains low at 0.15% and it is not listed in CISA KEV.
RemediationAI
Apply the primary fix by upgrading the Eventin plugin to version 4.1.16 or later (Vendor-released patch: 4.1.16), which enforces proper authorization on order creation and stops honoring attacker-supplied order status. Until the update is deployed, compensating controls include restricting or blocking public access to the plugin's order-creation REST/AJAX endpoints via a WAF rule, and reconciling recent orders against actual payment-gateway settlement records to detect and cancel any orders marked paid without a matching gateway transaction - accepting that a WAF rule may block legitimate checkout flows and reconciliation is detective rather than preventive. Reference the WPScan advisory (https://wpscan.com/vulnerability/09d6135f-b38c-4cfe-8a9f-5d79552c720c/) for confirmation. No availability impact means emergency downtime is not required, but patch promptly given the public exploit.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Eventin is a WordPress event-management and ticketing plugin whose order-processing workflow exposes an order-creation function that trusts client-supplied input. The flaw is CWE-639 (Authorization Bypass Through User-Controlled Key): the endpoint fails to enforce that the caller is authorized to create an order and, critically, accepts an attacker-controlled 'order status' parameter instead of deriving payment state from the payment gateway. The CPE (cpe:2.3:a:unknown:eventin:*) confirms the plugin itself is the affected component; the vendor field is recorded as 'unknown' in NVD data. The root cause is a classic mass-assignment/authorization gap where a security-relevant state field (paid/unpaid) is writable by the requester rather than by the server after gateway confirmation.
Know when Eventin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Unauthenticated network endpoint with no user interaction (AV:N/AC:L/PR:N/UI:N); attacker forges paid-order state, a high integrity impact with no confidentiality or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment.
Executive ViewAI
The Eventin WordPress plugin contains an authorization flaw enabling attackers to forge paid event orders without payment, creating direct revenue loss and fraud risk. Organizations running versions prior to 4.1.16 should prioritize patching to version 4.1.16 or later within 7 days.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Incorrect Privilege Assignment vulnerability in Themewinter Eventin allows Privilege Escalation.0.26. Rated critical sev
Unauthenticated account creation in the Eventin WordPress plugin (all versions before 4.1.20) allows any remote attacker
Eventin WordPress plugin versions before 4.1.20 exposes stored customer records - including names and email addresses -
Relative Path Traversal vulnerability in Themewinter Eventin allows Path Traversal.0.26. Rated high severity (CVSS 7.5),
Local file inclusion in the Eventin WordPress plugin (all versions before 4.1.20) allows authenticated users holding edi
Eventin WordPress plugin versions from 4.1.9 through 4.1.19 exposes customer order records - including personal informat
Local file inclusion in Eventin WordPress plugin before 4.1.21 enables authenticated contributors and higher-privileged
Missing authorization in the Eventin WordPress plugin before 4.1.24 allows unauthenticated attackers to reuse the order-
Unauthenticated information disclosure in the Eventin WordPress plugin before 4.1.22 exposes private, draft, and pending
Unauthenticated payment bypass in the Eventin WordPress plugin before 4.1.19 lets any visitor fraudulently obtain valid
Unauthenticated visitors can mark unpaid Eventin orders of any value as paid by replaying a single genuine low-value pay
Missing authorization on Eventin's event-management REST routes allows low-privilege WordPress contributors to perform i
Exploit-DB