WordPress Plugin Vulnerabilities

Eventin < 4.1.19 - Unauthenticated Order Completion Without Payment via order_token

Description

The plugin does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken.

Proof of Concept

Affects Plugins

Plugin icon
wp-event-solution
Fixed in 4.1.19

References

CVE
CVE-2026-77694

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Nir Yehoshua
Submitter
Nir Yehoshua
Submitter website
https://ciphersecuritylabs.com/
Submitter twitter
niryeho
Verified
Yes
WPVDB ID
2670eac4-b630-4546-9b56-f19feabfa550

Timeline

Publicly Published
2026-08-24 (about 23 days ago)
Added
2026-08-24 (about 22 days ago)
Last Updated
2026-08-24 (about 22 days ago)

Other

Published
Title
Published
2026-08-06
Title
Salon Booking System – Free Version < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering
Published
2026-05-11
Title
Motors – Car Dealership & Classified Listings Plugin < 1.4.104 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameter
Published
2026-01-09
Title
miniOrange OTP Verification and SMS Notification for WooCommerce < 4.3.9 - Missing Authorization to Unauthenticated Notification Settings Modification
Published
2026-03-10
Title
MC4WP: Mailchimp for WordPress < 4.12.0 - Unauthenticated Arbitrary Subscription Deletion
Published
2023-12-16
Title
SpeedyCache < 1.1.4 - Missing Authorization to Plugin Options Update