Unauthenticated Order Manipulation Vulnerability in Eventin Plugin for WordPress
CVE-2026-77694
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-77694?
The Eventin WordPress plugin prior to version 4.1.19 contains a security flaw that permits unauthorized users to exploit the guest checkout token mechanism. This vulnerability enables unauthenticated individuals to manipulate their own unpaid orders, marking them as completed and receiving valid paid tickets without the necessity for any financial transaction. Due to this oversight, website owners utilizing affected versions should update promptly to prevent unauthorized exploitation and potential revenue loss.
Affected Version(s)
Eventin 0 < 4.1.19
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.