EUVD-2026-51009
GHSA-5mvv-43fh-86fq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Unauthenticated network endpoint with no user interaction (AV:N/AC:L/PR:N/UI:N); attacker forges paid-order state, a high integrity impact with no confidentiality or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment.
AnalysisAI
Broken authorization in the Eventin WordPress plugin before 4.1.16 lets unauthenticated visitors create orders and supply their own order status, marking those orders as paid without ever completing payment. Because the order-creation endpoint neither authorizes the requester nor validates the payment state, remote attackers can forge fully-paid transactions, undermining ticket/event revenue integrity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target runs the Eventin WordPress plugin at a version below 4.1.16 with its order-creation endpoint reachable over the network (default for a public WordPress site). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) reflects a network-reachable, low-complexity, unauthenticated integrity attack with no confidentiality or availability impact - consistent with forging paid orders rather than data theft. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends a crafted unauthenticated HTTP request to Eventin's order-creation endpoint, including an 'order status' value set to paid/completed, and receives a fully-paid order (e.g., event tickets) without submitting any payment. Because a public POC exists and no authentication or user interaction is required, this can be scripted against any vulnerable site to obtain goods/tickets for free or to pollute order records. |
| Remediation | Apply the primary fix by upgrading the Eventin plugin to version 4.1.16 or later (Vendor-released patch: 4.1.16), which enforces proper authorization on order creation and stops honoring attacker-supplied order status. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Eventin installations and confirm current versions; notify event operations and finance teams of the exposure and potential transaction risks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated account creation in the Eventin WordPress plugin (all versions before 4.1.20) allows any remote attacker
Eventin WordPress plugin versions before 4.1.20 exposes stored customer records - including names and email addresses -
Local file inclusion in the Eventin WordPress plugin (all versions before 4.1.20) allows authenticated users holding edi
Eventin WordPress plugin versions from 4.1.9 through 4.1.19 exposes customer order records - including personal informat
Unauthenticated information disclosure in the Eventin WordPress plugin before 4.1.22 exposes private, draft, and pending
Unauthenticated payment bypass in the Eventin WordPress plugin before 4.1.19 lets any visitor fraudulently obtain valid
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to Local File In
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to Local File In
Reflected cross-site scripting in the Eventin WordPress plugin up to version 4.0.28 allows unauthenticated attackers to
Blind server-side request forgery in the Eventin WordPress plugin prior to version 4.1.21 allows contributor-level authe
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themewinter
The Event Manager, Events Calendar, Events Tickets for WooCommerce - Eventin plugin for WordPress is vulnerable to unaut
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today